nginx-proxy-manager/backend/internal/certificate.js

import fs from "node:fs";
import https from "node:https";
import path from "path";
import archiver from "archiver";
import _ from "lodash";
import moment from "moment";
import tempWrite from "temp-write";
import dnsPlugins from "../global/certbot-dns-plugins.json" with { type: "json" };
import { installPlugin } from "../lib/certbot.js";
import { useLetsencryptServer, useLetsencryptStaging } from "../lib/config.js";
import error from "../lib/error.js";
import utils from "../lib/utils.js";
import { ssl as logger } from "../logger.js";
import certificateModel from "../models/certificate.js";
import tokenModel from "../models/token.js";
import internalAuditLog from "./audit-log.js";
import internalHost from "./host.js";
import internalNginx from "./nginx.js";

const letsencryptConfig = "/etc/letsencrypt.ini";
const certbotCommand = "certbot";

const omissions = () => {
	return ["is_deleted", "owner.is_deleted"];
};

const internalCertificate = {
	allowedSslFiles: ["certificate", "certificate_key", "intermediate_certificate"],
	intervalTimeout: 1000 * 60 * 60, // 1 hour
	interval: null,
	intervalProcessing: false,
	renewBeforeExpirationBy: [30, "days"],

	initTimer: () => {
		logger.info("Let's Encrypt Renewal Timer initialized");
		internalCertificate.interval = setInterval(
			internalCertificate.processExpiringHosts,
			internalCertificate.intervalTimeout,
		);
		// And do this now as well
		internalCertificate.processExpiringHosts();
	},

	/**
	 * Triggered by a timer, this will check for expiring hosts and renew their ssl certs if required
	 */
	processExpiringHosts: () => {
		if (!internalCertificate.intervalProcessing) {
			internalCertificate.intervalProcessing = true;
			logger.info(
				`Renewing SSL certs expiring within ${internalCertificate.renewBeforeExpirationBy[0]} ${internalCertificate.renewBeforeExpirationBy[1]} ...`,
			);

			const expirationThreshold = moment()
				.add(internalCertificate.renewBeforeExpirationBy[0], internalCertificate.renewBeforeExpirationBy[1])
				.format("YYYY-MM-DD HH:mm:ss");

			// Fetch all the letsencrypt certs from the db that will expire within the configured threshold
			certificateModel
				.query()
				.where("is_deleted", 0)
				.andWhere("provider", "letsencrypt")
				.andWhere("expires_on", "<", expirationThreshold)
				.then((certificates) => {
					if (!certificates || !certificates.length) {
						return null;
					}

					/**
					 * Renews must be run sequentially or we'll get an error 'Another
					 * instance of Certbot is already running.'
					 */
					let sequence = Promise.resolve();

					certificates.forEach((certificate) => {
						sequence = sequence.then(() =>
							internalCertificate
								.renew(
									{
										can: () =>
											Promise.resolve({
												permission_visibility: "all",
											}),
										token: new tokenModel(),
									},
									{ id: certificate.id },
								)
								.catch((err) => {
									// Don't want to stop the train here, just log the error
									logger.error(err.message);
								}),
						);
					});

					return sequence;
				})
				.then(() => {
					logger.info("Completed SSL cert renew process");
					internalCertificate.intervalProcessing = false;
				})
				.catch((err) => {
					logger.error(err);
					internalCertificate.intervalProcessing = false;
				});
		}
	},

	/**
	 * @param   {Access}  access
	 * @param   {Object}  data
	 * @returns {Promise}
	 */
	create: (access, data) => {
		return access
			.can("certificates:create", data)
			.then(() => {
				data.owner_user_id = access.token.getUserId(1);

				if (data.provider === "letsencrypt") {
					data.nice_name = data.domain_names.join(", ");
				}

				return certificateModel.query().insertAndFetch(data).then(utils.omitRow(omissions()));
			})
			.then((certificate) => {
				if (certificate.provider === "letsencrypt") {
					// Request a new Cert from LE. Let the fun begin.

					// 1. Find out any hosts that are using any of the hostnames in this cert
					// 2. Disable them in nginx temporarily
					// 3. Generate the LE config
					// 4. Request cert
					// 5. Remove LE config
					// 6. Re-instate previously disabled hosts

					// 1. Find out any hosts that are using any of the hostnames in this cert
					return internalHost
						.getHostsWithDomains(certificate.domain_names)
						.then((in_use_result) => {
							// 2. Disable them in nginx temporarily
							return internalCertificate.disableInUseHosts(in_use_result).then(() => {
								return in_use_result;
							});
						})
						.then((in_use_result) => {
							// With DNS challenge no config is needed, so skip 3 and 5.
							if (certificate.meta.dns_challenge) {
								return internalNginx
									.reload()
									.then(() => {
										// 4. Request cert
										return internalCertificate.requestLetsEncryptSslWithDnsChallenge(certificate);
									})
									.then(internalNginx.reload)
									.then(() => {
										// 6. Re-instate previously disabled hosts
										return internalCertificate.enableInUseHosts(in_use_result);
									})
									.then(() => {
										return certificate;
									})
									.catch((err) => {
										// In the event of failure, revert things and throw err back
										return internalCertificate
											.enableInUseHosts(in_use_result)
											.then(internalNginx.reload)
											.then(() => {
												throw err;
											});
									});
							}
							// 3. Generate the LE config
							return internalNginx
								.generateLetsEncryptRequestConfig(certificate)
								.then(internalNginx.reload)
								.then(async () => await new Promise((r) => setTimeout(r, 5000)))
								.then(() => {
									// 4. Request cert
									return internalCertificate.requestLetsEncryptSsl(certificate);
								})
								.then(() => {
									// 5. Remove LE config
									return internalNginx.deleteLetsEncryptRequestConfig(certificate);
								})
								.then(internalNginx.reload)
								.then(() => {
									// 6. Re-instate previously disabled hosts
									return internalCertificate.enableInUseHosts(in_use_result);
								})
								.then(() => {
									return certificate;
								})
								.catch((err) => {
									// In the event of failure, revert things and throw err back
									return internalNginx
										.deleteLetsEncryptRequestConfig(certificate)
										.then(() => {
											return internalCertificate.enableInUseHosts(in_use_result);
										})
										.then(internalNginx.reload)
										.then(() => {
											throw err;
										});
								});
						})
						.then(() => {
							// At this point, the letsencrypt cert should exist on disk.
							// Lets get the expiry date from the file and update the row silently
							return internalCertificate
								.getCertificateInfoFromFile(
									`${internalCertificate.getLiveCertPath(certificate.id)}/fullchain.pem`,
								)
								.then((cert_info) => {
									return certificateModel
										.query()
										.patchAndFetchById(certificate.id, {
											expires_on: moment(cert_info.dates.to, "X").format("YYYY-MM-DD HH:mm:ss"),
										})
										.then(utils.omitRow(omissions()))
										.then((saved_row) => {
											// Add cert data for audit log
											saved_row.meta = _.assign({}, saved_row.meta, {
												letsencrypt_certificate: cert_info,
											});

											return saved_row;
										});
								});
						})
						.catch(async (error) => {
							// Delete the certificate from the database if it was not created successfully
							await certificateModel.query().deleteById(certificate.id);

							throw error;
						});
				}
				return certificate;
			})
			.then((certificate) => {
				data.meta = _.assign({}, data.meta || {}, certificate.meta);

				// Add to audit log
				return internalAuditLog
					.add(access, {
						action: "created",
						object_type: "certificate",
						object_id: certificate.id,
						meta: data,
					})
					.then(() => {
						return certificate;
					});
			});
	},

	/**
	 * @param  {Access}  access
	 * @param  {Object}  data
	 * @param  {Number}  data.id
	 * @param  {String}  [data.email]
	 * @param  {String}  [data.name]
	 * @return {Promise}
	 */
	update: (access, data) => {
		return access
			.can("certificates:update", data.id)
			.then((/*access_data*/) => {
				return internalCertificate.get(access, { id: data.id });
			})
			.then((row) => {
				if (row.id !== data.id) {
					// Sanity check that something crazy hasn't happened
					throw new error.InternalValidationError(
						`Certificate could not be updated, IDs do not match: ${row.id} !== ${data.id}`,
					);
				}

				return certificateModel
					.query()
					.patchAndFetchById(row.id, data)
					.then(utils.omitRow(omissions()))
					.then((saved_row) => {
						saved_row.meta = internalCertificate.cleanMeta(saved_row.meta);
						data.meta = internalCertificate.cleanMeta(data.meta);

						// Add row.nice_name for custom certs
						if (saved_row.provider === "other") {
							data.nice_name = saved_row.nice_name;
						}

						// Add to audit log
						return internalAuditLog
							.add(access, {
								action: "updated",
								object_type: "certificate",
								object_id: row.id,
								meta: _.omit(data, ["expires_on"]), // this prevents json circular reference because expires_on might be raw
							})
							.then(() => {
								return saved_row;
							});
					});
			});
	},

	/**
	 * @param  {Access}   access
	 * @param  {Object}   data
	 * @param  {Number}   data.id
	 * @param  {Array}    [data.expand]
	 * @param  {Array}    [data.omit]
	 * @return {Promise}
	 */
	get: (access, data) => {
		const thisData = data || {};

		return access
			.can("certificates:get", thisData.id)
			.then((accessData) => {
				const query = certificateModel
					.query()
					.where("is_deleted", 0)
					.andWhere("id", thisData.id)
					.allowGraph("[owner]")
					.allowGraph("[proxy_hosts]")
					.allowGraph("[redirection_hosts]")
					.allowGraph("[dead_hosts]")
					.first();

				if (accessData.permission_visibility !== "all") {
					query.andWhere("owner_user_id", access.token.getUserId(1));
				}

				if (typeof thisData.expand !== "undefined" && thisData.expand !== null) {
					query.withGraphFetched(`[${thisData.expand.join(", ")}]`);
				}

				return query.then(utils.omitRow(omissions()));
			})
			.then((row) => {
				if (!row || !row.id) {
					throw new error.ItemNotFoundError(thisData.id);
				}
				// Custom omissions
				if (typeof thisData.omit !== "undefined" && thisData.omit !== null) {
					return _.omit(row, thisData.omit);
				}
				return row;
			});
	},

	/**
	 * @param   {Access}  access
	 * @param   {Object}  data
	 * @param   {Number}  data.id
	 * @returns {Promise}
	 */
	download: (access, data) => {
		return new Promise((resolve, reject) => {
			access
				.can("certificates:get", data)
				.then(() => {
					return internalCertificate.get(access, data);
				})
				.then((certificate) => {
					if (certificate.provider === "letsencrypt") {
						const zipDirectory = internalCertificate.getLiveCertPath(data.id);

						if (!fs.existsSync(zipDirectory)) {
							throw new error.ItemNotFoundError(`Certificate ${certificate.nice_name} does not exists`);
						}

						const certFiles = fs
							.readdirSync(zipDirectory)
							.filter((fn) => fn.endsWith(".pem"))
							.map((fn) => fs.realpathSync(path.join(zipDirectory, fn)));
						const downloadName = `npm-${data.id}-${Date.now()}.zip`;
						const opName = `/tmp/${downloadName}`;
						internalCertificate
							.zipFiles(certFiles, opName)
							.then(() => {
								logger.debug("zip completed : ", opName);
								const resp = {
									fileName: opName,
								};
								resolve(resp);
							})
							.catch((err) => reject(err));
					} else {
						throw new error.ValidationError("Only Let'sEncrypt certificates can be downloaded");
					}
				})
				.catch((err) => reject(err));
		});
	},

	/**
	 * @param   {String}  source
	 * @param   {String}  out
	 * @returns {Promise}
	 */
	zipFiles(source, out) {
		const archive = archiver("zip", { zlib: { level: 9 } });
		const stream = fs.createWriteStream(out);

		return new Promise((resolve, reject) => {
			source.map((fl) => {
				const fileName = path.basename(fl);
				logger.debug(fl, "added to certificate zip");
				archive.file(fl, { name: fileName });
				return true;
			});
			archive.on("error", (err) => reject(err)).pipe(stream);
			stream.on("close", () => resolve());
			archive.finalize();
		});
	},

	/**
	 * @param {Access}  access
	 * @param {Object}  data
	 * @param {Number}  data.id
	 * @param {String}  [data.reason]
	 * @returns {Promise}
	 */
	delete: (access, data) => {
		return access
			.can("certificates:delete", data.id)
			.then(() => {
				return internalCertificate.get(access, { id: data.id });
			})
			.then((row) => {
				if (!row || !row.id) {
					throw new error.ItemNotFoundError(data.id);
				}

				return certificateModel
					.query()
					.where("id", row.id)
					.patch({
						is_deleted: 1,
					})
					.then(() => {
						// Add to audit log
						row.meta = internalCertificate.cleanMeta(row.meta);

						return internalAuditLog.add(access, {
							action: "deleted",
							object_type: "certificate",
							object_id: row.id,
							meta: _.omit(row, omissions()),
						});
					})
					.then(() => {
						if (row.provider === "letsencrypt") {
							// Revoke the cert
							return internalCertificate.revokeLetsEncryptSsl(row);
						}
					});
			})
			.then(() => {
				return true;
			});
	},

	/**
	 * All Certs
	 *
	 * @param   {Access}  access
	 * @param   {Array}   [expand]
	 * @param   {String}  [search_query]
	 * @returns {Promise}
	 */
	getAll: (access, expand, search_query) => {
		return access.can("certificates:list").then((access_data) => {
			const query = certificateModel
				.query()
				.where("is_deleted", 0)
				.groupBy("id")
				.allowGraph("[owner]")
				.allowGraph("[proxy_hosts]")
				.allowGraph("[redirection_hosts]")
				.allowGraph("[dead_hosts]")
				.orderBy("nice_name", "ASC");

			if (access_data.permission_visibility !== "all") {
				query.andWhere("owner_user_id", access.token.getUserId(1));
			}

			// Query is used for searching
			if (typeof search_query === "string") {
				query.where(function () {
					this.where("nice_name", "like", `%${search_query}%`);
				});
			}

			if (typeof expand !== "undefined" && expand !== null) {
				query.withGraphFetched(`[${expand.join(", ")}]`);
			}

			return query.then(utils.omitRows(omissions()));
		});
	},

	/**
	 * Report use
	 *
	 * @param   {Number}  user_id
	 * @param   {String}  visibility
	 * @returns {Promise}
	 */
	getCount: (user_id, visibility) => {
		const query = certificateModel.query().count("id as count").where("is_deleted", 0);

		if (visibility !== "all") {
			query.andWhere("owner_user_id", user_id);
		}

		return query.first().then((row) => {
			return Number.parseInt(row.count, 10);
		});
	},

	/**
	 * @param   {Object} certificate
	 * @returns {Promise}
	 */
	writeCustomCert: (certificate) => {
		logger.info("Writing Custom Certificate:", certificate);

		const dir = `/data/custom_ssl/npm-${certificate.id}`;

		return new Promise((resolve, reject) => {
			if (certificate.provider === "letsencrypt") {
				reject(new Error("Refusing to write letsencrypt certs here"));
				return;
			}

			let certData = certificate.meta.certificate;
			if (typeof certificate.meta.intermediate_certificate !== "undefined") {
				certData = `${certData}\n${certificate.meta.intermediate_certificate}`;
			}

			try {
				if (!fs.existsSync(dir)) {
					fs.mkdirSync(dir);
				}
			} catch (err) {
				reject(err);
				return;
			}

			fs.writeFile(`${dir}/fullchain.pem`, certData, (err) => {
				if (err) {
					reject(err);
				} else {
					resolve();
				}
			});
		}).then(() => {
			return new Promise((resolve, reject) => {
				fs.writeFile(`${dir}/privkey.pem`, certificate.meta.certificate_key, (err) => {
					if (err) {
						reject(err);
					} else {
						resolve();
					}
				});
			});
		});
	},

	/**
	 * @param   {Access}   access
	 * @param   {Object}   data
	 * @param   {Array}    data.domain_names
	 * @param   {String}   data.meta.letsencrypt_email
	 * @param   {Boolean}  data.meta.letsencrypt_agree
	 * @returns {Promise}
	 */
	createQuickCertificate: (access, data) => {
		return internalCertificate.create(access, {
			provider: "letsencrypt",
			domain_names: data.domain_names,
			meta: data.meta,
		});
	},

	/**
	 * Validates that the certs provided are good.
	 * No access required here, nothing is changed or stored.
	 *
	 * @param   {Object}  data
	 * @param   {Object}  data.files
	 * @returns {Promise}
	 */
	validate: (data) => {
		return new Promise((resolve) => {
			// Put file contents into an object
			const files = {};
			_.map(data.files, (file, name) => {
				if (internalCertificate.allowedSslFiles.indexOf(name) !== -1) {
					files[name] = file.data.toString();
				}
			});

			resolve(files);
		}).then((files) => {
			// For each file, create a temp file and write the contents to it
			// Then test it depending on the file type
			const promises = [];
			_.map(files, (content, type) => {
				promises.push(
					new Promise((resolve) => {
						if (type === "certificate_key") {
							resolve(internalCertificate.checkPrivateKey(content));
						} else {
							// this should handle `certificate` and intermediate certificate
							resolve(internalCertificate.getCertificateInfo(content, true));
						}
					}).then((res) => {
						return { [type]: res };
					}),
				);
			});

			return Promise.all(promises).then((files) => {
				let data = {};

				_.each(files, (file) => {
					data = _.assign({}, data, file);
				});

				return data;
			});
		});
	},

	/**
	 * @param   {Access}  access
	 * @param   {Object}  data
	 * @param   {Number}  data.id
	 * @param   {Object}  data.files
	 * @returns {Promise}
	 */
	upload: (access, data) => {
		return internalCertificate.get(access, { id: data.id }).then((row) => {
			if (row.provider !== "other") {
				throw new error.ValidationError("Cannot upload certificates for this type of provider");
			}

			return internalCertificate
				.validate(data)
				.then((validations) => {
					if (typeof validations.certificate === "undefined") {
						throw new error.ValidationError("Certificate file was not provided");
					}

					_.map(data.files, (file, name) => {
						if (internalCertificate.allowedSslFiles.indexOf(name) !== -1) {
							row.meta[name] = file.data.toString();
						}
					});

					// TODO: This uses a mysql only raw function that won't translate to postgres
					return internalCertificate
						.update(access, {
							id: data.id,
							expires_on: moment(validations.certificate.dates.to, "X").format("YYYY-MM-DD HH:mm:ss"),
							domain_names: [validations.certificate.cn],
							meta: _.clone(row.meta), // Prevent the update method from changing this value that we'll use later
						})
						.then((certificate) => {
							certificate.meta = row.meta;
							return internalCertificate.writeCustomCert(certificate);
						});
				})
				.then(() => {
					return _.pick(row.meta, internalCertificate.allowedSslFiles);
				});
		});
	},

	/**
	 * Uses the openssl command to validate the private key.
	 * It will save the file to disk first, then run commands on it, then delete the file.
	 *
	 * @param {String}  private_key    This is the entire key contents as a string
	 */
	checkPrivateKey: (private_key) => {
		return tempWrite(private_key, "/tmp").then((filepath) => {
			return new Promise((resolve, reject) => {
				const failTimeout = setTimeout(() => {
					reject(
						new error.ValidationError(
							"Result Validation Error: Validation timed out. This could be due to the key being passphrase-protected.",
						),
					);
				}, 10000);
				utils
					.exec(`openssl pkey -in ${filepath} -check -noout 2>&1 `)
					.then((result) => {
						clearTimeout(failTimeout);
						if (!result.toLowerCase().includes("key is valid")) {
							reject(new error.ValidationError(`Result Validation Error: ${result}`));
						}
						fs.unlinkSync(filepath);
						resolve(true);
					})
					.catch((err) => {
						clearTimeout(failTimeout);
						fs.unlinkSync(filepath);
						reject(new error.ValidationError(`Certificate Key is not valid (${err.message})`, err));
					});
			});
		});
	},

	/**
	 * Uses the openssl command to both validate and get info out of the certificate.
	 * It will save the file to disk first, then run commands on it, then delete the file.
	 *
	 * @param {String}  certificate      This is the entire cert contents as a string
	 * @param {Boolean} [throw_expired]  Throw when the certificate is out of date
	 */
	getCertificateInfo: (certificate, throw_expired) => {
		return tempWrite(certificate, "/tmp").then((filepath) => {
			return internalCertificate
				.getCertificateInfoFromFile(filepath, throw_expired)
				.then((certData) => {
					fs.unlinkSync(filepath);
					return certData;
				})
				.catch((err) => {
					fs.unlinkSync(filepath);
					throw err;
				});
		});
	},

	/**
	 * Uses the openssl command to both validate and get info out of the certificate.
	 * It will save the file to disk first, then run commands on it, then delete the file.
	 *
	 * @param {String}  certificate_file The file location on disk
	 * @param {Boolean} [throw_expired]  Throw when the certificate is out of date
	 */
	getCertificateInfoFromFile: (certificate_file, throw_expired) => {
		const certData = {};

		return utils
			.execFile("openssl", ["x509", "-in", certificate_file, "-subject", "-noout"])
			.then((result) => {
				// Examples:
				// subject=CN = *.jc21.com
				// subject=CN = something.example.com
				const regex = /(?:subject=)?[^=]+=\s+(\S+)/gim;
				const match = regex.exec(result);
				if (match && typeof match[1] !== "undefined") {
					certData.cn = match[1];
				}
			})
			.then(() => {
				return utils.execFile("openssl", ["x509", "-in", certificate_file, "-issuer", "-noout"]);
			})

			.then((result) => {
				// Examples:
				// issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
				// issuer=C = US, O = Let's Encrypt, CN = E5
				// issuer=O = NginxProxyManager, CN = NginxProxyManager Intermediate CA","O = NginxProxyManager, CN = NginxProxyManager Intermediate CA
				const regex = /^(?:issuer=)?(.*)$/gim;
				const match = regex.exec(result);
				if (match && typeof match[1] !== "undefined") {
					certData.issuer = match[1];
				}
			})
			.then(() => {
				return utils.execFile("openssl", ["x509", "-in", certificate_file, "-dates", "-noout"]);
			})
			.then((result) => {
				// notBefore=Jul 14 04:04:29 2018 GMT
				// notAfter=Oct 12 04:04:29 2018 GMT
				let validFrom = null;
				let validTo = null;

				const lines = result.split("\n");
				lines.map((str) => {
					const regex = /^(\S+)=(.*)$/gim;
					const match = regex.exec(str.trim());

					if (match && typeof match[2] !== "undefined") {
						const date = Number.parseInt(moment(match[2], "MMM DD HH:mm:ss YYYY z").format("X"), 10);

						if (match[1].toLowerCase() === "notbefore") {
							validFrom = date;
						} else if (match[1].toLowerCase() === "notafter") {
							validTo = date;
						}
					}
					return true;
				});

				if (!validFrom || !validTo) {
					throw new error.ValidationError(`Could not determine dates from certificate: ${result}`);
				}

				if (throw_expired && validTo < Number.parseInt(moment().format("X"), 10)) {
					throw new error.ValidationError("Certificate has expired");
				}

				certData.dates = {
					from: validFrom,
					to: validTo,
				};

				return certData;
			})
			.catch((err) => {
				throw new error.ValidationError(`Certificate is not valid (${err.message})`, err);
			});
	},

	/**
	 * Cleans the ssl keys from the meta object and sets them to "true"
	 *
	 * @param   {Object}  meta
	 * @param   {Boolean} [remove]
	 * @returns {Object}
	 */
	cleanMeta: (meta, remove) => {
		internalCertificate.allowedSslFiles.map((key) => {
			if (typeof meta[key] !== "undefined" && meta[key]) {
				if (remove) {
					delete meta[key];
				} else {
					meta[key] = true;
				}
			}
			return true;
		});

		return meta;
	},

	/**
	 * Request a certificate using the http challenge
	 * @param   {Object}  certificate   the certificate row
	 * @returns {Promise}
	 */
	requestLetsEncryptSsl: (certificate) => {
		logger.info(
			`Requesting LetsEncrypt certificates for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const args = [
			"certonly",
			"--config",
			letsencryptConfig,
			"--work-dir",
			"/tmp/letsencrypt-lib",
			"--logs-dir",
			"/tmp/letsencrypt-log",
			"--cert-name",
			`npm-${certificate.id}`,
			"--agree-tos",
			"--authenticator",
			"webroot",
			"--email",
			certificate.meta.letsencrypt_email,
			"--preferred-challenges",
			"dns,http",
			"--domains",
			certificate.domain_names.join(","),
		];

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		return utils.execFile(certbotCommand, args, adds.opts).then((result) => {
			logger.success(result);
			return result;
		});
	},

	/**
	 * @param   {Object}         certificate          the certificate row
	 * @param   {String}         dns_provider         the dns provider name (key used in `certbot-dns-plugins.json`)
	 * @param   {String | null}  credentials          the content of this providers credentials file
	 * @param   {String}         propagation_seconds
	 * @returns {Promise}
	 */
	requestLetsEncryptSslWithDnsChallenge: async (certificate) => {
		await installPlugin(certificate.meta.dns_provider);
		const dnsPlugin = dnsPlugins[certificate.meta.dns_provider];
		logger.info(
			`Requesting LetsEncrypt certificates via ${dnsPlugin.name} for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const credentialsLocation = `/etc/letsencrypt/credentials/credentials-${certificate.id}`;
		fs.mkdirSync("/etc/letsencrypt/credentials", { recursive: true });
		fs.writeFileSync(credentialsLocation, certificate.meta.dns_provider_credentials, { mode: 0o600 });

		// Whether the plugin has a --<name>-credentials argument
		const hasConfigArg = certificate.meta.dns_provider !== "route53";

		const args = [
			"certonly",
			"--config",
			letsencryptConfig,
			"--work-dir",
			"/tmp/letsencrypt-lib",
			"--logs-dir",
			"/tmp/letsencrypt-log",
			"--cert-name",
			`npm-${certificate.id}`,
			"--agree-tos",
			"--email",
			certificate.meta.letsencrypt_email,
			"--domains",
			certificate.domain_names.join(","),
			"--authenticator",
			dnsPlugin.full_plugin_name,
		];

		if (hasConfigArg) {
			args.push(`--${dnsPlugin.full_plugin_name}-credentials`, credentialsLocation);
		}
		if (certificate.meta.propagation_seconds !== undefined) {
			args.push(
				`--${dnsPlugin.full_plugin_name}-propagation-seconds`,
				certificate.meta.propagation_seconds.toString(),
			);
		}

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		try {
			const result = await utils.execFile(certbotCommand, args, adds.opts);
			logger.info(result);
			return result;
		} catch (err) {
			// Don't fail if file does not exist, so no need for action in the callback
			fs.unlink(credentialsLocation, () => {});
			throw err;
		}
	},

	/**
	 * @param   {Access}  access
	 * @param   {Object}  data
	 * @param   {Number}  data.id
	 * @returns {Promise}
	 */
	renew: (access, data) => {
		return access
			.can("certificates:update", data)
			.then(() => {
				return internalCertificate.get(access, data);
			})
			.then((certificate) => {
				if (certificate.provider === "letsencrypt") {
					const renewMethod = certificate.meta.dns_challenge
						? internalCertificate.renewLetsEncryptSslWithDnsChallenge
						: internalCertificate.renewLetsEncryptSsl;

					return renewMethod(certificate)
						.then(() => {
							return internalCertificate.getCertificateInfoFromFile(
								`${internalCertificate.getLiveCertPath(certificate.id)}/fullchain.pem`,
							);
						})
						.then((cert_info) => {
							return certificateModel.query().patchAndFetchById(certificate.id, {
								expires_on: moment(cert_info.dates.to, "X").format("YYYY-MM-DD HH:mm:ss"),
							});
						})
						.then((updated_certificate) => {
							// Add to audit log
							return internalAuditLog
								.add(access, {
									action: "renewed",
									object_type: "certificate",
									object_id: updated_certificate.id,
									meta: updated_certificate,
								})
								.then(() => {
									return updated_certificate;
								});
						});
				}
				throw new error.ValidationError("Only Let'sEncrypt certificates can be renewed");
			});
	},

	/**
	 * @param   {Object}  certificate   the certificate row
	 * @returns {Promise}
	 */
	renewLetsEncryptSsl: (certificate) => {
		logger.info(
			`Renewing LetsEncrypt certificates for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const args = [
			"renew",
			"--force-renewal",
			"--config",
			letsencryptConfig,
			"--work-dir",
			"/tmp/letsencrypt-lib",
			"--logs-dir",
			"/tmp/letsencrypt-log",
			"--cert-name",
			`npm-${certificate.id}`,
			"--preferred-challenges",
			"dns,http",
			"--no-random-sleep-on-renew",
			"--disable-hook-validation",
		];

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		return utils.execFile(certbotCommand, args, adds.opts).then((result) => {
			logger.info(result);
			return result;
		});
	},

	/**
	 * @param   {Object}  certificate   the certificate row
	 * @returns {Promise}
	 */
	renewLetsEncryptSslWithDnsChallenge: (certificate) => {
		const dnsPlugin = dnsPlugins[certificate.meta.dns_provider];

		if (!dnsPlugin) {
			throw Error(`Unknown DNS provider '${certificate.meta.dns_provider}'`);
		}

		logger.info(
			`Renewing LetsEncrypt certificates via ${dnsPlugin.name} for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const args = [
			"renew",
			"--force-renewal",
			"--config",
			letsencryptConfig,
			"--work-dir",
			"/tmp/letsencrypt-lib",
			"--logs-dir",
			"/tmp/letsencrypt-log",
			"--cert-name",
			`npm-${certificate.id}`,
			"--disable-hook-validation",
			"--no-random-sleep-on-renew",
		];

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		return utils.execFile(certbotCommand, args, adds.opts).then(async (result) => {
			logger.info(result);
			return result;
		});
	},

	/**
	 * @param   {Object}  certificate    the certificate row
	 * @param   {Boolean} [throw_errors]
	 * @returns {Promise}
	 */
	revokeLetsEncryptSsl: (certificate, throw_errors) => {
		logger.info(
			`Revoking LetsEncrypt certificates for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const args = [
			"revoke",
			"--config",
			letsencryptConfig,
			"--work-dir",
			"/tmp/letsencrypt-lib",
			"--logs-dir",
			"/tmp/letsencrypt-log",
			"--cert-path",
			`${internalCertificate.getLiveCertPath(certificate.id)}/fullchain.pem`,
			"--delete-after-revoke",
		];

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		return utils
			.execFile(certbotCommand, args, adds.opts)
			.then(async (result) => {
				await utils.exec(`rm -f '/etc/letsencrypt/credentials/credentials-${certificate.id}' || true`);
				logger.info(result);
				return result;
			})
			.catch((err) => {
				logger.error(err.message);

				if (throw_errors) {
					throw err;
				}
			});
	},

	/**
	 * @param   {Object}  certificate
	 * @returns {Boolean}
	 */
	hasLetsEncryptSslCerts: (certificate) => {
		const letsencryptPath = internalCertificate.getLiveCertPath(certificate.id);
		return fs.existsSync(`${letsencryptPath}/fullchain.pem`) && fs.existsSync(`${letsencryptPath}/privkey.pem`);
	},

	/**
	 * @param {Object}  in_use_result
	 * @param {Number}  in_use_result.total_count
	 * @param {Array}   in_use_result.proxy_hosts
	 * @param {Array}   in_use_result.redirection_hosts
	 * @param {Array}   in_use_result.dead_hosts
	 */
	disableInUseHosts: (in_use_result) => {
		if (in_use_result.total_count) {
			const promises = [];

			if (in_use_result.proxy_hosts.length) {
				promises.push(internalNginx.bulkDeleteConfigs("proxy_host", in_use_result.proxy_hosts));
			}

			if (in_use_result.redirection_hosts.length) {
				promises.push(internalNginx.bulkDeleteConfigs("redirection_host", in_use_result.redirection_hosts));
			}

			if (in_use_result.dead_hosts.length) {
				promises.push(internalNginx.bulkDeleteConfigs("dead_host", in_use_result.dead_hosts));
			}

			return Promise.all(promises);
		}
		return Promise.resolve();
	},

	/**
	 * @param {Object}  in_use_result
	 * @param {Number}  in_use_result.total_count
	 * @param {Array}   in_use_result.proxy_hosts
	 * @param {Array}   in_use_result.redirection_hosts
	 * @param {Array}   in_use_result.dead_hosts
	 */
	enableInUseHosts: (in_use_result) => {
		if (in_use_result.total_count) {
			const promises = [];

			if (in_use_result.proxy_hosts.length) {
				promises.push(internalNginx.bulkGenerateConfigs("proxy_host", in_use_result.proxy_hosts));
			}

			if (in_use_result.redirection_hosts.length) {
				promises.push(internalNginx.bulkGenerateConfigs("redirection_host", in_use_result.redirection_hosts));
			}

			if (in_use_result.dead_hosts.length) {
				promises.push(internalNginx.bulkGenerateConfigs("dead_host", in_use_result.dead_hosts));
			}

			return Promise.all(promises);
		}
		return Promise.resolve();
	},

	testHttpsChallenge: async (access, domains) => {
		await access.can("certificates:list");

		if (!isArray(domains)) {
			throw new error.InternalValidationError("Domains must be an array of strings");
		}
		if (domains.length === 0) {
			throw new error.InternalValidationError("No domains provided");
		}

		// Create a test challenge file
		const testChallengeDir = "/data/letsencrypt-acme-challenge/.well-known/acme-challenge";
		const testChallengeFile = `${testChallengeDir}/test-challenge`;
		fs.mkdirSync(testChallengeDir, { recursive: true });
		fs.writeFileSync(testChallengeFile, "Success", { encoding: "utf8" });

		async function performTestForDomain(domain) {
			logger.info(`Testing http challenge for ${domain}`);
			const url = `http://${domain}/.well-known/acme-challenge/test-challenge`;
			const formBody = `method=G&url=${encodeURI(url)}&bodytype=T&requestbody=&headername=User-Agent&headervalue=None&locationid=1&ch=false&cc=false`;
			const options = {
				method: "POST",
				headers: {
					"User-Agent": "Mozilla/5.0",
					"Content-Type": "application/x-www-form-urlencoded",
					"Content-Length": Buffer.byteLength(formBody),
				},
			};

			const result = await new Promise((resolve) => {
				const req = https.request("https://www.site24x7.com/tools/restapi-tester", options, (res) => {
					let responseBody = "";

					res.on("data", (chunk) => {
						responseBody = responseBody + chunk;
					});

					res.on("end", () => {
						try {
							const parsedBody = JSON.parse(`${responseBody}`);
							if (res.statusCode !== 200) {
								logger.warn(
									`Failed to test HTTP challenge for domain ${domain} because HTTP status code ${res.statusCode} was returned: ${parsedBody.message}`,
								);
								resolve(undefined);
							} else {
								resolve(parsedBody);
							}
						} catch (err) {
							if (res.statusCode !== 200) {
								logger.warn(
									`Failed to test HTTP challenge for domain ${domain} because HTTP status code ${res.statusCode} was returned`,
								);
							} else {
								logger.warn(
									`Failed to test HTTP challenge for domain ${domain} because response failed to be parsed: ${err.message}`,
								);
							}
							resolve(undefined);
						}
					});
				});

				// Make sure to write the request body.
				req.write(formBody);
				req.end();
				req.on("error", (e) => {
					logger.warn(`Failed to test HTTP challenge for domain ${domain}`, e);
					resolve(undefined);
				});
			});

			if (!result) {
				// Some error occurred while trying to get the data
				return "failed";
			}
			if (result.error) {
				logger.info(
					`HTTP challenge test failed for domain ${domain} because error was returned: ${result.error.msg}`,
				);
				return `other:${result.error.msg}`;
			}
			if (`${result.responsecode}` === "200" && result.htmlresponse === "Success") {
				// Server exists and has responded with the correct data
				return "ok";
			}
			if (`${result.responsecode}` === "200") {
				// Server exists but has responded with wrong data
				logger.info(
					`HTTP challenge test failed for domain ${domain} because of invalid returned data:`,
					result.htmlresponse,
				);
				return "wrong-data";
			}
			if (`${result.responsecode}` === "404") {
				// Server exists but responded with a 404
				logger.info(`HTTP challenge test failed for domain ${domain} because code 404 was returned`);
				return "404";
			}
			if (
				`${result.responsecode}` === "0" ||
				(typeof result.reason === "string" && result.reason.toLowerCase() === "host unavailable")
			) {
				// Server does not exist at domain
				logger.info(`HTTP challenge test failed for domain ${domain} the host was not found`);
				return "no-host";
			}
			// Other errors
			logger.info(
				`HTTP challenge test failed for domain ${domain} because code ${result.responsecode} was returned`,
			);
			return `other:${result.responsecode}`;
		}

		const results = {};

		for (const domain of domains) {
			results[domain] = await performTestForDomain(domain);
		}

		// Remove the test challenge file
		fs.unlinkSync(testChallengeFile);

		return results;
	},

	getAdditionalCertbotArgs: (certificate_id, dns_provider) => {
		const args = [];
		if (useLetsencryptServer() !== null) {
			args.push("--server", useLetsencryptServer());
		}
		if (useLetsencryptStaging() && useLetsencryptServer() === null) {
			args.push("--staging");
		}

		// For route53, add the credentials file as an environment variable,
		// inheriting the process env
		const opts = {};
		if (certificate_id && dns_provider === "route53") {
			opts.env = process.env;
			opts.env.AWS_CONFIG_FILE = `/etc/letsencrypt/credentials/credentials-${certificate_id}`;
		}

		if (dns_provider === "duckdns") {
			args.push("--dns-duckdns-no-txt-restore");
		}

		return { args: args, opts: opts };
	},

	getLiveCertPath: (certificate_id) => {
		return `/etc/letsencrypt/live/npm-${certificate_id}`;
	},
};

export default internalCertificate;