Harden AIA proxy and expand FPKI domain allow list

Security: block query strings, credentials, non-standard ports, and
fragments in proxied URLs. Validate redirect targets against the domain
allow list to prevent open redirect abuse. Reconstruct URLs from
validated components instead of forwarding raw input.

Add 29 domains covering US Government PKI (.gov/.mil), FPKI Shared
Service Providers (Entrust, WidePoint, DigiCert Federal, IdenTrust),
FPKI Bridge participants (CertiPath, defense contractors, DirectTrust),
and Bavarian State PKI.

Author: danielewood

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.2] - 2026-02-15
+
+### Security
+
+- Harden AIA proxy: block query strings, URL credentials, non-standard ports, and fragments in proxied URLs
+- Harden AIA proxy: validate redirect targets against domain allow list to prevent open redirect abuse
+- Harden AIA proxy: reconstruct URLs from validated components instead of forwarding raw input
+
+### Added
+
+- Add US Government PKI domains to AIA proxy allow list: DoD/DISA, Treasury SSP, State Department, USPTO, Veterans Affairs
+- Add FPKI Shared Service Provider domains to AIA proxy allow list: Entrust Federal, WidePoint/ORC, DigiCert Federal SSP, DigiCert/Symantec legacy, IdenTrust
+- Add FPKI Bridge participant domains to AIA proxy allow list: CertiPath, Boeing, Lockheed Martin, Northrop Grumman, Raytheon/RTX, Exostar, Carillon, STRAC/FTI, DirectTrust SAFE, Verizon SSP, DocuSign Federal
+- Add Bavarian State PKI (`www.pki.bayern.de`) to AIA proxy allow list
+
 ## [0.7.1] - 2026-02-15
 
 ### Changed
@@ -306,7 +321,8 @@ Initial release.
 - PKCS#12, PKCS#7, and JKS encode/decode support
 - Homebrew distribution via GoReleaser
 
-[Unreleased]: https://github.com/sensiblebit/certkit/compare/v0.7.1...HEAD
+[Unreleased]: https://github.com/sensiblebit/certkit/compare/v0.7.2...HEAD
+[0.7.2]: https://github.com/sensiblebit/certkit/compare/v0.7.1...v0.7.2
 [0.7.1]: https://github.com/sensiblebit/certkit/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/sensiblebit/certkit/compare/v0.6.7...v0.7.0
 [0.6.7]: https://github.com/sensiblebit/certkit/compare/v0.6.0...v0.6.7

web/functions/api/fetch.ts

@@ -73,10 +73,69 @@ const ALLOWED_DOMAINS: string[] = [
   "rapidssl-aia.geotrust.com",
   // E-Tugra (Turkish CA)
   "www.e-tugra.com",
-  // US Federal PKI
+  // ── US Federal PKI (.gov / .mil) ──
+  // FPKI repository (GSA)
   "repo.fpki.gov",
+  "http.fpki.gov",
+  // US DoD PKI (DISA) — suffix covers crl.disa.mil, crl.nit.disa.mil,
+  // crl.gds.disa.mil, crl.gds.nit.disa.mil, and future subdomains.
+  "disa.mil",
+  // US Treasury PKI SSP (serves DHS, VA, NASA, SSA, Treasury OCIO)
+  "pki.treas.gov",
+  "pki.treasury.gov",
+  // US Department of State
+  "crls.pki.state.gov",
+  // US Patent and Trademark Office
+  "ipki.uspto.gov",
+  // US Department of Veterans Affairs
+  "crl.pki.va.gov",
+  // ── FPKI Shared Service Providers ──
+  // Entrust Federal SSP — suffix covers sspweb, rootweb, nfimediumsspweb,
+  // fedrootg2crl, feddcsweb, hhspkicrl subdomains.
+  "managed.entrust.com",
+  // WidePoint / ORC PKI
+  "crl-server.orc.com",
+  "eva.orc.com",
+  "eca.orc.com",
+  "crl.xca.xpki.com",
+  // DigiCert Federal SSP
+  "ssp-aia.digicert.com",
+  "ssp-crl.digicert.com",
+  "ssp-sia.digicert.com",
+  "onsite-crl.pki.digicert.com",
+  // DigiCert / Symantec legacy — suffix covers pki-crl, tscp-crl,
+  // tscp-aia, tscp-sia subdomains.
+  "symauth.com",
+  // IdenTrust (FPKI bridge participant)
+  "apps.identrust.com",
+  "validation.identrust.com",
+  // ── FPKI Bridge Participants ──
+  // CertiPath Bridge — suffix covers crl. and aia. subdomains.
+  "certipath.com",
+  // Defense contractors
+  "crl.boeing.com",
+  "crl.external.lmco.com",
+  "certdata.northropgrumman.com",
+  "pki.rtx.com",
+  // Exostar
+  "www.fis.evincible.com",
+  // Carillon (Canadian FPKI bridge partner)
+  "pub.carillon.ca",
+  "pub.carillonfedserv.com",
+  // STRAC / Foundation for Trusted Identity
+  "pki.strac.org",
+  "pki.fti.org",
+  // DirectTrust SAFE Identity Bridge — suffix covers crl. and aia.
+  "makeidentitysafe.com",
+  // Verizon SSP
+  "sia1.ssp-strong-id.net",
+  // DocuSign Federal
+  "crl.dsf.docusign.net",
+  // ── Non-US Government PKI ──
   // Swiss Federal PKI
   "www.pki.admin.ch",
+  // Bavarian State PKI
+  "www.pki.bayern.de",
   // TBS Internet
   "crt.tbs-internet.com",
   "crt.tbs-x509.com",
@@ -89,6 +148,44 @@ function isAllowedDomain(hostname: string): boolean {
   );
 }
 
+// Follows redirects manually, re-validating each target against the domain
+// allow list. Prevents open redirects on allowed domains from bouncing to
+// arbitrary URLs.
+const MAX_REDIRECTS = 5;
+
+async function safeFetch(url: string): Promise<Response> {
+  let currentURL = url;
+  for (let i = 0; i <= MAX_REDIRECTS; i++) {
+    const resp = await fetch(currentURL, {
+      headers: { "User-Agent": "certkit AIA proxy/1.0" },
+      redirect: "manual",
+    });
+
+    // Not a redirect — return as-is.
+    if (resp.status < 300 || resp.status >= 400) {
+      return resp;
+    }
+
+    const location = resp.headers.get("Location");
+    if (!location) {
+      return resp;
+    }
+
+    const target = new URL(location, currentURL);
+    if (target.protocol !== "https:" && target.protocol !== "http:") {
+      throw new Error("Redirect to non-HTTP protocol");
+    }
+    if (!isAllowedDomain(target.hostname)) {
+      throw new Error(`Redirect to disallowed domain '${target.hostname}'`);
+    }
+
+    // Sanitize redirect URL — only keep protocol, host, and path.
+    currentURL = `${target.protocol}//${target.hostname}${target.pathname}`;
+  }
+
+  throw new Error("Too many redirects");
+}
+
 export const onRequestOptions: PagesFunction = async ({ request }) => {
   const origin = request.headers.get("Origin");
   return new Response(null, { status: 204, headers: corsHeaders(origin) });
@@ -125,10 +222,25 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
     return errorResponse(400, "Invalid URL", origin);
   }
 
+  // Block credentials in URL
+  if (parsed.username || parsed.password) {
+    return errorResponse(400, "URLs with credentials are not allowed", origin);
+  }
+
+  // Block non-standard ports — CA AIA endpoints use default ports only
+  if (parsed.port) {
+    return errorResponse(400, "Non-standard ports are not allowed", origin);
+  }
+
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
     return errorResponse(400, "Only HTTP/HTTPS URLs are allowed", origin);
   }
 
+  // Block query strings and fragments — AIA URLs are static file paths
+  if (parsed.search || parsed.hash) {
+    return errorResponse(400, "Query strings and fragments are not allowed", origin);
+  }
+
   if (!isAllowedDomain(parsed.hostname)) {
     return errorResponse(
       403,
@@ -153,22 +265,22 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
     return errorResponse(403, "URL path does not look like a certificate file", origin);
   }
 
+  // Reconstruct from validated components — never forward the raw input URL.
+  const sanitizedURL = `${parsed.protocol}//${parsed.hostname}${parsed.pathname}`;
+
   // Try the URL as given. If HTTPS fails with an SSL error, fall back to HTTP
   // (many CA AIA endpoints only serve plain HTTP).
-  const urlsToTry = [targetURL];
+  const urlsToTry = [sanitizedURL];
   if (parsed.protocol === "https:") {
-    urlsToTry.push(targetURL.replace(/^https:/, "http:"));
+    urlsToTry.push(`http://${parsed.hostname}${parsed.pathname}`);
   }
 
   let lastStatus = 502;
   let lastMessage = "All fetch attempts failed";
 
   for (const tryURL of urlsToTry) {
     try {
-      const upstream = await fetch(tryURL, {
-        headers: { "User-Agent": "certkit AIA proxy/1.0" },
-        redirect: "follow",
-      });
+      const upstream = await safeFetch(tryURL);
 
       if (!upstream.ok) {
         lastStatus = upstream.status;