DEV Community: Fakhrulhilal M

Applying CI/CD for classic ASP project

Fakhrulhilal M — Thu, 29 Jul 2021 09:00:29 +0000

A new challenge to add CI/CD support for classic ASP. You might be wondering why I take care of classic ASP project for nowadays😂. But I believe one of you know the reason already😁. Classic ASP project doesn't have configuration system by default. It used to store in ordinary ASP file and place anything in VBscript variables, f.e. config.asp. Fortunately, they used to store in centralized place, so we don't have to scan all configurations in many files.
So the basic idea is simple, introduce placeholder format and replace it before deploying. Let's use #PLACEHOLDER# as an example. I prefer to use all caps so I can pay attention easily what needed to be changed. See example below:

<%

Dim cfgSocials
Set cfgSocials = Server.CreateObject("Scripting.Dictionary")
cfgSocials.Add "github", "#SOCIAL_GITHUB#"
cfgSocials.Add "twitter", "#SOCIAL_TWITTER#"
cfgSocials.Add "linkedin", "#SOCIAL_LINKEDIN#"
cfgSocials.Add "email", "#SOCIAL_EMAIL#"

Dim cfgSite
Set cfgSite = Server.CreateObject("Scripting.Dictionary")
cfgSite.Add "name", "Portofolio"
cfgSite.Add "fullname", "#FULL_NAME#"
cfgSite.Add "address", "#ADDRESS#"

%>

After that, all we need to do read file content, and do find-replace based on placeholder. I'm a fan of powershell, because it's easy to write the script and its dotnet support is deadly insane👍. Here's the quick snippet

function Get-Value([string]$Key) {
    $Value = $Configs[$Key]
    if (-not([string]::IsNullOrEmpty($Value))) {
        $Value
    } else {
        [System.Environment]::GetEnvironmentVariable($Key)
    }
}

$PlaceholderPattern = [regex]::new('#(?<placeholder>\w+)#')
$ParsedContent = Get-Content -Path $Path | %{
    $PlaceholderPattern.Replace($_, {
        param($Match)
        if ($Match.Success) {
            $Value = Get-Value -Key $Match.Groups['placeholder'].Value
            if (-not([string]::IsNullOrEmpty($Value))) {
                $Value
            } else {
                $Match.Value
            }
        } else {
            $Match.Value
        }
    })
}
Set-Content -Path $Path -Value $ParsedContent

In azure pipeline, it exposes all variables to environment variables. So it's easy to populate from pipeline definition to file.

Take a look at demo repo and give me feedback😊. I put all the details there.

Getting started with GPG key for signing git commit

Fakhrulhilal M — Sun, 04 Jul 2021 05:27:49 +0000

Configuring Git and GPG

After installing git, you need to add git's binary path to the PATH environment, located in %ProgramFiles%\Git\usr\bin.

GPG Key

Create new key

Generate a key: gpg --default-new-key-algo rsa4096 --gen-key. After that, check again with this command: gpg --list-secret-keys --keyid-format LONG, result example:

$ gpg --list-secret-keys --keyid-format LONG
/c/Users/fmaktum/.gnupg/pubring.gpg
-----------------------------------
sec   rsa4096/E170165D27E434C2 2018-07-22 [SC] [expires: 2022-07-23]
      FE428E022494CC3ED85ACDD3E170165D27E434C2
uid                 [ultimate] Fakhrulhilal Maktum <fakhrulhilal@gmail.com>
uid                 [ultimate] Fakhrulhilal Maktum <fakhrulhilal@outlook.com>
uid                 [ultimate] [jpeg image of size 13093]
ssb   rsa4096/C0D8267ED759FC4B 2018-07-22 [E] [expires: 2022-07-23]

in that case, key ID is 3AA5C34371567BD2.

Next, we need to associate with the email address. To do that, we need to edit first by this command: gpg --edit-key 3AA5C34371567BD2

gpg> adduid
Real name: Fakhrulhilal Maktum
Email address: fakhrulhilal@outlook.com
Comment: 
You selected this USER-ID:
    "Fakhrulhilal Maktum <fakhrulhilal@outlook.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

Optionally, we can add the picture (suggested to use 240x288)

gpg> addphoto

After all changes, we can know save it

gpg> save

Extending Expired Public Key

You need to edit the key by using this command: gpg --edit-key:

gpg> expire
Changing expiration time for a subkey.
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 2y
Key expires at Sun Jul 24 06:36:28 2022 SEAST
Is this correct? (y/N) y

sec  rsa4096/E170165D27E434C2
     created: 2018-07-22  expires: 2023-07-23  usage: SC
     trust: ultimate      validity: ultimate
ssb* rsa4096/C0D8267ED759FC4B
     created: 2018-07-22  expires: 2022-07-23  usage: E
[ultimate] (1). Fakhrulhilal Maktum <fakhrulhilal@gmail.com>
[ultimate] (2)  Fakhrulhilal Maktum <fakhrulhilal@outlook.com>
[ultimate] (3)  [jpeg image of size 13093]

gpg> key 1

sec  rsa4096/E170165D27E434C2
     created: 2018-07-22  expires: 2023-07-23  usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa4096/C0D8267ED759FC4B
     created: 2018-07-22  expires: 2022-07-23  usage: E
[ultimate] (1). Fakhrulhilal Maktum <fakhrulhilal@gmail.com>
[ultimate] (2)  Fakhrulhilal Maktum <fakhrulhilal@outlook.com>
[ultimate] (3)  [jpeg image of size 13093]

gpg> expire
Changing expiration time for the primary key.
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 2y
Key expires at Sun Jul 24 06:36:36 2022 SEAST
Is this correct? (y/N) y

sec  rsa4096/E170165D27E434C2
     created: 2018-07-22  expires: 2022-07-23  usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa4096/C0D8267ED759FC4B
     created: 2018-07-22  expires: 2022-07-23  usage: E
[ultimate] (1). Fakhrulhilal Maktum <fakhrulhilal@gmail.com>
[ultimate] (2)  Fakhrulhilal Maktum <fakhrulhilal@outlook.com>
[ultimate] (3)  [jpeg image of size 13093]

The first key is for extending primary key, the second command is for extending sub encryption key.

Backup GPG Key

The easy way to backup all keys is by copy-paste the database

public keys: %UserProfile%\.gnupg\pubring.gpg
secret keys: %UserProfile%\.gnupg\secring.gpg
trust db: %UserProfile%\.gnupg\trustdb.gpg

GPG manual suggests this command to backup trust db: gpg --export-ownertrust > gpg-owner-trust.txt.

To backup individual key:

public key: gpg --armor --export E170165D27E434C2 > public.gpg
secret key: gpg --armor --export-secret-key E170165D27E434C2> secret.asc

Or you can use the email address instead of the key ID, f.e. git --armor --export fakhrulhilal@gmail.com > public.gpg. Note that, secret key always contains public key.

We can also publish the GPG key to public server with this command: gpg --keyserver [server address] --send-keys fakhrulhilal@gmail.com. Some notable PGP public key servers:

pgp.mit.edu
pgp.key-server.io
keyserver.pgp.com

Import/Restore GPG Key

Importing secret key (along with public key): gpg --import fakhrulhilal@gmail.com.asc. After that, import all owner trust: gpg --import-ownertrust gpg-owner-trust.txt. Alternatively, we can trust by each key:

$ gpg --edit-key fakhrulhilal@gmail.com
gpg> trust
Your decision? 5 (Ultimate trust)

Sharing GPG key to public key server

Below is currently active keyservers:

pgp.mit.edu
keyserver.ubuntu.com
keys.openpgp.org
keyserver1.pgp.com

To upload the key using gpg command, use gpg --keyserver the_server --send-keys E170165D27E434C2. Another way is by uploading manually to them. So we need to go their website and upload the key, commonly, they accept ASCII version of public key (gpg --export --armor E170165D27E434C2)

Associating Git with GPG

Setting GPG key for git commit

Set the key by using this command: git config user.signingkey E170165D27E434C2. And then we can sign the commit by -S option. Alternatively, we can force all commit to be signed using this command git config commit.gpgsign true, so we don't have to specify -S parameter each time committing the change.

Uploading public key to github

First, we need to backup the public key as follows: gpg --armor --export E170165D27E434C2 > fakhrulhilal.gpg

Login to your github account
Go to menu Settings > SSH and GPG keys
Add new gpg key
Copy-paste from fakhrulhilal.gpg content then save it

References

Creating SSL Certificate with Custom CA

Fakhrulhilal M — Sun, 04 Jul 2021 05:15:51 +0000

Creating Default OpenSSL Config File

Creating Custom Root CA

Creating the CA key:
openssl genrsa -des3 -out root-CA.key 4096
Note: remove -des option to create key without password

Creating self sign CA certificate

openssl req -x509 -new -nodes -key root-CA.key -sha256 -days 3650 -out root-CA.crt `
    -subj "/C=ID/O=Dev lab/CN=Dev lab Root CA" `
    -addext 'keyUsage = cRLSign, keyCertSign, digitalSignature' `
    -addext 'extendedKeyUsage = critical, serverAuth, clientAuth, codeSigning, emailProtection, timeStamping' `
    -addext 'subjectKeyIdentifier=hash' `
    -addext 'authorityKeyIdentifier=keyid:always,issuer:always' `
    -addext "basicConstraints = critical, CA:TRUE"

Explanations:

subj
create unattended answer subject
basicConstraints
CA:TRUE means it's issuer
keyUsage
determine what's this cert for: certificate signing (keyCertSign), CRL signing (cRLSign), digital signature
extendedKeyUsage
an extended version of keyUsage: server authentication (serverAuth), client authentication (clientAuth), file/code signing (codeSigning), S/MIME signing (emailProtection), time stamping
subjectKeyIdentifier
identifier of this cert
authoritykKeyIdentifier

the identifier which signs the cert, if it's root cert, then it should be itself

Shorter version

openssl req -config openssl.cnf -x509 -new -nodes -key root-CA.key -out root-CA.crt -days 3650 -extensions ca_cert -subj "/C=ID/O=Dev Lab/CN=Dev Lab Root CA"

Reference: OpenSSL man page

Inspect root CA certificate
openssl x509 -noout -text -in root-CA.crt

Convert into PKCS12 (.pfx) format
openssl pkcs12 -export -name "Root CA" -out root-CA.pfx -inkey root-CA.key -in root-CA.crt
Then import the pfx file into local machine placed under Trusted Root Certification Authorities

Creating Intermediate CA

Creating the intermedia CA key
openssl genrsa -out server-CA.key 4096

Creating intermediate certificate request

openssl req -new -key server-CA.key -out server-CA.csr -subj "/C=ID/O=Dev Lab/OU=Development/CN=Dev Lab Server CA"

Sign the intermedia CA certificate's request with CA's key and cert:
openssl x509 -extfile openssl.cnf -req -in server-CA.csr -CA root-CA.crt -CAkey root-CA.key -CAcreateserial -out server-CA.crt -extensions ica_cert -days 3650

Inspect root CA certificate
openssl x509 -noout -text -in server-CA.crt

Convert into PKCS12 format
openssl pkcs12 -export -name "Dev lab Server CA" -inkey server-CA.key -in server-CA.crt -out server-CA.pfx
Then import the pfx file into local machine placed under Intermediate Certification Authorities

Creating User Certificate

Creating the certificate key
openssl genrsa -out dev.lab.key 2048

Before moving on, the openssl config is configured to accept subject alternate name from environment variable named SAN (see line 176), so you need to configure first, otherwise, it will fail: $Env:SAN = 'DNS:*.dev.lab, DNS:dev.lab'. You can set it to the same as CN if you don't want to assign it to wilcard domain. We can also assign it to IP address as follows: $Env:SAN = 'DNS:*.dev.lab,DNS:dev.lab,DNS:localhost,IP:127.0.0.1'. After that, we can continue to create certificate request

openssl req -new -key dev.lab.key -out dev.lab.csr -subj "/C=ID/ST=Jakarta/O=Dev Home/OU=Development/CN=*.dev.lab"

Sign the certificate request using server CA's key and certificate

openssl x509 -extfile openssl.cnf -extensions web_cert -req -CA server-CA.crt `
    -CAkey server-CA.key -CAcreateserial -days 365 `
    -in dev.lab.csr -out dev.lab.crt

Convert into PKCS12 format
openssl pkcs12 -export -name "dev.lab Certificate" -inkey dev.lab.key -in dev.lab.crt -out dev.lab.pfx

Import the .pfx file into local machine using default location.

Creating S/MIME Certificate

Creating the certificate key

openssl genrsa -out iroel-email.key 2048

Creating certificate request
openssl req -new -key iroel-email.key -out iroel-email.csr -subj "/C=ID/ST=Jakarta/CN=Fakhrulhilal Maktum/emailAddress=iroel@dev.lab" -addext "subjectAltName = email:iroel@dev.lab, email:iroel@other.lab"

Sign the certificate request using server CA's key and certificate

$Env:SAN = 'email:iroel@dev.lab, email:iroel@dev.test'
openssl x509 -extfile openssl.cnf -extensions smime_cert -req -CA server-CA.crt `
    -CAkey server-CA.key -CAcreateserial -setalias "Dev email certificate" `
    -in iroel-email.csr -out iroel-email.crt -trustout -days 365

Convert into PKCS12 format
openssl pkcs12 -export -name "wilcard.dev.lab Certificate" -inkey dev.lab.key -in dev.lab.crt -out dev.lab.pfx

Import the .pfx file into local machine using default location.

Installing Certificates

Installing CAs' Certificate

Install root certificate (root-CA.crt) to Trusted Root Certification Authorities in machine level
Install intermediate certificate (server-CA.crt) to Intermediate Certification Authorities

Install IIS Express Certificate

Install the certificate in Local Machine wide and in default location (Personal). Run this powershell with administrator privilege. Friendly name is -name parameter value when converting into PKCS12 format.

$PfxPassword = 'pfx_password'
#$Certificate = Get-ChildItem Cert:\LocalMachine\My | ?{ $_.FriendlyName -eq 'localhost' }
$Certificate = Get-PfxCertificate -FilePath .\dev.lab.pfx -Password (ConvertTo-SecureString -String $PfxPassword -AsPlainText)
$IisExpress = Get-CimInstance Win32_Product -Filter 'Name like "IIS%Express%"'
for ($Port = 44300; $Port -lt 44400; $Port++) {
    netsh http delete sslcert ipport=0.0.0.0:$Port
    netsh http add sslcert ipport=0.0.0.0:$Port  certhash="$($Certificate.Thumbprint)"  appid="$($IisExpress.IdentifyingNumber)"
}

Installing Kestrel Certificate

Using environment variable
ASPNETCORE_Kestrel__Certificates__Default__Path = path to pfx file
ASPNETCORE_Kestrel__Certificates__Default__Password = pfx's password
Using appsettings.json

{
  "Kestrel": {
    "Certificates": {
      "Default": {
        "Path": "path/to/pfx/file",
        "Password": "pfx's password",
        /* or using .crt and key file */
        /*
        "Path": "path/to/crt/file",
        "KeyPath": "path/to/key/file"
        */
      }
    }
  }
}

Reference: Configure endpoints for the ASP.NET Core Kestrel web server

Using dotnet tool: dotnet dev-certs https --clean -i .\dev.lab.pfx -p the_password

Installing remote desktop certificate

$PfxPassword = 'pfx_password'
#$Certificate = Get-ChildItem Cert:\LocalMachine\My | ?{ $_.FriendlyName -eq 'localhost' }
$Certificate = Get-PfxCertificate -FilePath .\dev.lab.pfx -Password (ConvertTo-SecureString -String $PfxPassword -AsPlainText)
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="$($Certificate.Thumbprint)"