Node.js环境下能否仅用内置模块不借助外部模块创建X509证书？

crypto.X509Certificate 类仅用于解析、校验已存在的合法X509证书，不提供证书生成能力，无有效证书内容直接调用构造函数必然报错。Node.js 16.x 版本内置模块没有封装高层证书生成API，但可以通过内置crypto模块配合手动实现ASN.1 DER编码，纯内置模块完成证书生成，无需依赖第三方npm包或外部openssl命令。

const crypto = require('crypto');
const { Buffer } = require('buffer');

// ASN.1 DER 基础编码工具
function derEncodeLen(len) {
  if (len < 128) return Buffer.from([len]);
  const byteStack = [];
  while (len > 0) {
    byteStack.unshift(len & 0xff);
    len = len >> 8;
  }
  return Buffer.concat([Buffer.from([0x80 | byteStack.length]), Buffer.from(byteStack)]);
}
function derEncodeSeq() {
  const content = Buffer.concat(Array.from(arguments));
  return Buffer.concat([Buffer.from([0x30]), derEncodeLen(content.length), content]);
}
function derEncodeInt(val) {
  let valBuf;
  if (Buffer.isBuffer(val)) {
    valBuf = val;
    if (valBuf[0] & 0x80) valBuf = Buffer.concat([Buffer.from([0x00]), valBuf]);
  } else {
    valBuf = Buffer.alloc(4);
    valBuf.writeUInt32BE(val);
    while (valBuf.length > 1 && valBuf[0] === 0) valBuf = valBuf.slice(1);
    if (valBuf[0] & 0x80) valBuf = Buffer.concat([Buffer.from([0x00]), valBuf]);
  }
  return Buffer.concat([Buffer.from([0x02]), derEncodeLen(valBuf.length), valBuf]);
}
function derEncodeOid(oid) {
  const parts = oid.split('.').map(Number);
  const bytes = [parts[0] * 40 + parts[1]];
  for (let i = 2; i < parts.length; i++) {
    let num = parts[i];
    const encStack = [num & 0x7f];
    num = num >> 7;
    while (num > 0) {
      encStack.unshift(0x80 | (num & 0x7f));
      num = num >> 7;
    }
    bytes.push(...encStack);
  }
  const content = Buffer.from(bytes);
  return Buffer.concat([Buffer.from([0x06]), derEncodeLen(content.length), content]);
}
function derEncodeUtf8Str(str) {
  const content = Buffer.from(str, 'utf8');
  return Buffer.concat([Buffer.from([0x0c]), derEncodeLen(content.length), content]);
}
function derEncodeSet() {
  const content = Buffer.concat(Array.from(arguments));
  return Buffer.concat([Buffer.from([0x31]), derEncodeLen(content.length), content]);
}
function derEncodeBitString(buf) {
  return Buffer.concat([Buffer.from([0x03]), derEncodeLen(buf.length + 1), Buffer.from([0x00]), buf]);
}

/**
 * 生成RSA自签名X509v3证书
 * @param {Object} options
 * @param {string} options.commonName 证书通用名
 * @param {number} options.validDays 证书有效期天数
 * @returns {{cert: string, privateKey: string, publicKey: string}} PEM格式证书、私钥、公钥
 */
function generateSelfSignedCert(options = {}) {
  const { commonName = 'localhost', validDays = 365 } = options;
  // 生成2048位RSA密钥对
  const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: { type: 'spki', format: 'der' },
    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
  });

  // 组装TBS证书结构
  const versionBlock = (() => {
    const verVal = derEncodeInt(Buffer.from([0x02])); // v3版本对应编码值2
    return Buffer.concat([Buffer.from([0xa0]), derEncodeLen(verVal.length), verVal]);
  })();
  const serialNum = derEncodeInt(crypto.randomBytes(16)); // 随机16字节序列号
  const signAlgo = derEncodeSeq(derEncodeOid('1.2.840.113549.1.1.11'), Buffer.from([0x05, 0x00])); // SHA256WithRSA
  const dnBlock = derEncodeSeq(
    derEncodeSet(derEncodeSeq(derEncodeOid('2.5.4.3'), derEncodeUtf8Str(commonName)))
  );
  // 有效期编码（UTCTime格式，支持2049年之前的时间）
  const encodeUtcTime = (date) => {
    const timeStr = date.toISOString().replace(/[-:T]/g, '').slice(0, 12) + 'Z';
    const buf = Buffer.from(timeStr, 'ascii');
    return Buffer.concat([Buffer.from([0x17]), derEncodeLen(buf.length), buf]);
  };
  const notBefore = new Date();
  const notAfter = new Date(notBefore.getTime() + validDays * 86400000);
  const validityBlock = derEncodeSeq(encodeUtcTime(notBefore), encodeUtcTime(notAfter));
  const pubKeyBlock = derEncodeBitString(publicKey);
  // 基础约束扩展：非CA证书
  const extBlock = (() => {
    const basicConstraint = derEncodeSeq(
      derEncodeOid('2.5.29.19'),
      derEncodeSeq(Buffer.from([0x01, 0x01, 0x00]))
    );
    const extContent = derEncodeSeq(basicConstraint);
    return Buffer.concat([Buffer.from([0xa3]), derEncodeLen(extContent.length), extContent]);
  })();

  const tbsCert = derEncodeSeq(
    versionBlock,
    serialNum,
    signAlgo,
    dnBlock,
    validityBlock,
    dnBlock,
    pubKeyBlock,
    extBlock
  );
  // 签名并组装完整证书
  const signature = crypto.sign('sha256', tbsCert, privateKey);
  const fullCertDer = derEncodeSeq(tbsCert, signAlgo, derEncodeBitString(signature));
  // 转PEM格式
  const certPem = `-----BEGIN CERTIFICATE-----\n${fullCertDer.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
  const pubPem = `-----BEGIN PUBLIC KEY-----\n${publicKey.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END PUBLIC KEY-----\n`;

  return { cert: certPem, privateKey, publicKey: pubPem };
}

// 用法示例
const { cert, privateKey } = generateSelfSignedCert({ commonName: 'dev.local', validDays: 365 });
// 验证生成的证书可被X509Certificate正常解析
const parsedCert = new crypto.X509Certificate(cert);
console.log('证书生成成功，主体信息：', parsedCert.subject);

• 代码无任何第三方依赖，直接保存为.js文件即可在Node.js 16.14.2环境下运行
• 生成的证书符合X509 v3标准，可直接用于内置https模块搭建本地HTTPS服务
• 如果需要添加SAN域名、自定义DN属性、密钥用途等扩展字段，按照ASN.1编码规则补充对应结构即可，无需调用外部程序
• 代码中已经内置证书解析校验逻辑，生成的证书可以正常被X509Certificate类加载，不会再出现构造函数报错

内容的提问来源于stack exchange，提问作者hanwoong cho