[範例] 使用 node-forge 解析憑證 | 自然人憑證開發筆記

自然人憑證的公鑰可以解析出使用者的公鑰、姓名、身分證末四碼等資訊。

Demo#

程式碼#

Javascript 用來讀取憑證

1
<script src="https://cdn.jsdelivr.net/npm/node-forge@1.3.1/dist/forge.min.js"></script>
2

3
<h1>自然人憑證 解析憑證</h1>
4
<button onclick="openPopupForm(0)">讀取根憑證</button>
5
<button onclick="openPopupForm(1)">讀取中繼憑證</button>
6
<button onclick="openPopupForm(2)">讀取簽章憑證</button>
7
<button onclick="openPopupForm(3)">讀取加密憑證</button>
8
<br /><br />
9
憑證<br />
10
<textarea id="certb64" rows="8" cols="65"></textarea><br>
11
<button onclick="submit()">解析</button>
12
<hr />
13
<pre id="result"></pre>

1
let popupForm;
2
let timeout;
3
let num;
4

5
function openPopupForm(certnum) {
6
  num = certnum;
7
  popupForm = window.open(
8
    "http://localhost:61161/popupForm",
9
    "popupForm",
10
    "height=200, width=200, left=100, top=20"
11
  );
12
  timeout = setTimeout(() => {
13
    popupForm.close();
14
    alert("尚未安裝元件");
15
  }, 5000);
16
}
17

18
function receiveMessage(event) {
19
  if (event.origin !== "http://localhost:61161") return;
20

21
  let ret = JSON.parse(event.data);
22
  if (ret.func === "getTbs") {
23
    clearTimeout(timeout);
24
    const tbsData = { func: "GetUserCert" };
25
    popupForm.postMessage(JSON.stringify(tbsData), "*");
26
  } else {
27
    const data = JSON.parse(event.data);
28
    const certs = data.slots[0].token.certs;
29
    document.getElementsByName("certb64")[0].value = certs[num].certb64;
30
  }
31
}
32

33
window.addEventListener("message", receiveMessage, false);
34

35
function submit() {
36
  const begin = "-----BEGIN CERTIFICATE-----";
37
  const end = "-----END CERTIFICATE-----";
38

39
  // 載入憑證
40
  const certb64 = begin + document.getElementById("certb64").value + end;
41
  const cert = forge.pki.certificateFromPem(certb64);
42

43
  // 建置回傳的JSON，toUtf8用於解決中文亂碼問題
44
  const result = {};
45
  result["subject"] = toUtf8(cert.subject);
46
  result["issuer"] = toUtf8(cert.issuer);
47
  result["validity"] = cert.validity;
48
  result["extensions"] = cert.extensions;
49
  result["serialNumber"] = cert.serialNumber;
50
  result["publicKey"] = cert.publicKey;
51
  const publicKeyPem = forge.pki.publicKeyToPem(cert.publicKey);
52
  const publicKeyB64 = publicKeyPem
53
    .replace("-----BEGIN PUBLIC KEY-----", "")
54
    .replace("-----END PUBLIC KEY-----", "")
55
    .replaceAll("\r\n", "");
56
  result["publicKeyB64"] = publicKeyB64;
57

58
  document.getElementById("result").innerHTML = JSON.stringify(result, null, 2);
59
}
60

61
// 將object中所有value轉為utf8
62
function toUtf8(obj) {
63
  if (typeof obj === "object" && obj !== null) {
64
    for (const key in obj) {
65
      if (Object.prototype.hasOwnProperty.call(obj, key)) {
66
        obj[key] = toUtf8(obj[key]);
67
      }
68
    }
69
    return obj;
70
  } else if (typeof obj === "string") {
71
    const textDecoder = new TextDecoder("utf-8");
72
    const byteArray = new Uint8Array([...obj].map((c) => c.charCodeAt(0)));
73
    return textDecoder.decode(byteArray);
74
  } else {
75
    return obj;
76
  }
77
}

Response 範例#

以簽章憑證為例，說明如下：

subject：本憑證資訊，個人憑證含姓名
issuer：上級憑證資訊
validity：有效期限
extensions：擴充欄位
- subjectDirectoryAttributes：字串末四碼為身分證末四碼
publicKey：公鑰的物件
publicKeyB64：公鑰的 Base64，與 /pkcs11info?withcert=true 中的公鑰Base64 相同

1
{
2
  "subject": {
3
    "attributes": [
4
      {
5
        "type": "2.5.4.6",
6
        "value": "TW",
7
        "valueTagClass": 19,
8
        "name": "countryName",
9
        "shortName": "C"
10
      },
11
      {
12
        "type": "2.5.4.3",
13
        "value": "周詳",
14
        "valueTagClass": 12,
15
        "name": "commonName",
16
        "shortName": "CN"
17
      },
18
      {
19
        "type": "2.5.4.5",
20
        "value": "00000001....",
21
        "valueTagClass": 19,
22
        "name": "serialNumber"
23
      }
24
    ],
25
    "hash": "d64b521011538e55864524a...."
26
  },
27
  "issuer": {
28
    "attributes": [
29
      {
30
        "type": "2.5.4.6",
31
        "value": "TW",
32
        "valueTagClass": 19,
33
        "name": "countryName",
34
        "shortName": "C"
35
      },
36
      {
37
        "type": "2.5.4.10",
38
        "value": "行政院",
39
        "valueTagClass": 12,
40
        "name": "organizationName",
41
        "shortName": "O"
42
      },
43
      {
44
        "type": "2.5.4.11",
45
        "value": "內政部憑證管理中心",
46
        "valueTagClass": 12,
47
        "name": "organizationalUnitName",
48
        "shortName": "OU"
49
      }
50
    ],
51
    "hash": "25ab5e84667697ec05...."
52
  },
53
  "validity": {
54
    "notBefore": "2020-11-12T01:17:56.000Z",
55
    "notAfter": "2025-11-12T15:59:59.000Z"
56
  },
57
  "extensions": [
58
    {
59
      "id": "2.5.29.35",
60
      "critical": false,
61
      "value": "0\u0016\u0014ú4g\t\n\"÷bH&¦EÅÃ\"¤",
62
      "name": "authorityKeyIdentifier"
63
    },
64
    {
65
      "id": "2.5.29.14",
66
      "critical": false,
67
      "value": "\u0004\u0014sqdñ)?U\u001eo\u0000é\u0019w(¼n",
68
      "name": "subjectKeyIdentifier",
69
      "subjectKeyIdentifier": "7371649af1293f551e6f00e999197728bc87826e"
70
    },
71
    {
72
      "id": "1.3.6.1.5.5.7.1.1",
73
      "critical": false,
74
      "value": "00G\u0006\b+\u0006\u0001\u0005\u0005\u00070\u0002;http://moica.nat.gov.tw/repository/Certs/IssuedToThisCA.p7b0A\u0006\b+\u0006\u0001\u0005\u0005\u00070\u00015http://moica.nat.gov.tw/cgi-bin/OCSP2/ocsp_server.exe",
75
      "name": "authorityInfoAccess"
76
    },
77
    {
78
      "id": "2.5.29.15",
79
      "critical": true,
80
      "value": "\u0003\u0002\u0007",
81
      "name": "keyUsage",
82
      "digitalSignature": true,
83
      "nonRepudiation": false,
84
      "keyEncipherment": false,
85
      "dataEncipherment": false,
86
      "keyAgreement": false,
87
      "keyCertSign": false,
88
      "cRLSign": false,
89
      "encipherOnly": false,
90
      "decipherOnly": false
91
    },
92
    {
93
      "id": "2.5.29.32",
94
      "critical": false,
95
      "value": "0\u000b0\t\u0006\u0007`ve\u0000\u0003\u0003",
96
      "name": "certificatePolicies"
97
    },
98
    {
99
      "id": "2.5.29.9",
100
      "critical": false,
101
      "value": "0*0\u0015\u0006\u0007`v\u0001d\u0002\u00011\n\u0006\b`v\u0001d\u0003\u0001\u00010\u0011\u0006\u0007`v\u0001d\u000231\u0006\f\u00041234",
102
      "name": "subjectDirectoryAttributes"
103
    },
104
    {
105
      "id": "2.5.29.31",
106
      "critical": false,
107
      "value": "00@ > <:http://moica.nat.gov.tw/repository/MOICA/CRL2/CRL_0028.crl0@ > <:http://moica.nat.gov.tw/repository/MOICA/CRL2/complete.crl",
108
      "name": "cRLDistributionPoints"
109
    }
110
  ],
111
  "serialNumber": "00d43a822d041...",
112
  "publicKey": {
113
    "n": {
114
      "data": [
115
        13863697,
116
        47207358,
117
        ...
118
      ],
119
      "t": 79,
120
      "s": 0
121
    },
122
    "e": {
123
      "data": [
124
        65537
125
      ],
126
      "t": 1,
127
      "s": 0
128
    }
129
  },
130
  "publicKeyB64": "MIIBIjANBgkqhkiG9w0BA...."
131
}