Skip to main content

The password and the certificate

A password, a passphrase, a user certificate and a private key come in the message only.

Why they are not in the dialog​

A value in the dialog goes into the flow file. The flow file stores it as plain, readable text. It goes out with every export of the flow, and anyone who can read the flow can read it. So the dialog never holds these values.

  • They come in msg.config: password, userCertificate, userPrivatekey and userPrivatekeyPassphrase.
  • They stay in memory. The node never writes them to disk, to a log, to a status or to an output.
  • In their place, the dialog tells that they come in the message.
  • A flow file can hold one of them in the node, after an edit by hand. The node ignores the value. It warns at deploy, once for each field. The warning names the field, never the value.

After a deploy or a restart, the endpoint uses its own settings again. A dashboard must then send the secret again. Get the settings tells if a secret is held (hasPassword, hasPrivateKey). It never sends the secret.

A user name and a password​

msg.action = "connect";
msg.config = {
    userIdentityType: "UserName",
    userName: "operator",
    password: "secret"
};
  • userName: at most 256 characters.
  • password: at most 1024 characters.
  • A user name login needs the security mode Sign or SignAndEncrypt. With None, the password is not encrypted, so the message gets an error message on securityMode.

A user certificate​

msg.config = {
    userIdentityType: "Certificate",
    userCertificate: "-----BEGIN CERTIFICATE-----\n...",
    userPrivatekey: "-----BEGIN ENCRYPTED PRIVATE KEY-----\n...",
    userPrivatekeyPassphrase: "only for an encrypted key"
};
  • userCertificate: one PEM certificate with an RSA key.
    • EC and Ed25519 keys are not supported.
    • A chain is refused.
    • A certificate that has expired, or that is not valid yet, is refused.
  • userPrivatekey: PEM text.
    • The node accepts PKCS#8 (BEGIN PRIVATE KEY), PKCS#1 (BEGIN RSA PRIVATE KEY), and both forms encrypted.
    • The key must be an RSA key, and it must belong to the certificate.
  • userPrivatekeyPassphrase: necessary for an encrypted key.
    • A wrong passphrase is refused.
    • A passphrase with a key that is not encrypted gets an error message on userPrivatekeyPassphrase. A blank passphrase counts as absent.
  • Each PEM text has at most 16384 characters. The passphrase has at most 1024.

The node checks all of this before it switches. A fault gets an error message on userCertificate, userPrivatekey or userPrivatekeyPassphrase. The running session stays. If a key is not valid, the node does not try another key.

What the user certificate is not​

The user certificate and its key are the login of the operator on the server. They are not the certificate of this Node-RED instance. They are the only certificate data that a message can bring. The node does not touch the application certificate or the PKI.