package-lock update

add new attribute types to certificates

.gitignore

@@ -1 +1,2 @@
-node_modules/
+node_modules/
+.idea/

README.MD

@@ -6,7 +6,7 @@ MADCert is a cross-platform tool that consists of a certificate generator, a fil
 
 MADCert does not require openssl or any other programs to be installed in the Operating System.
 
-Both Node.js and CLI exmples are provided below.
+Both Node.js and CLI examples are provided below.
 
 
 ## Usage
@@ -49,7 +49,7 @@ To add MADCert to your project:
 
         madcert.listCACerts();
 
--   List Server Cerficates
+-   List Server Certificates
 
         madcert.listServerCerts();
 
@@ -63,18 +63,29 @@ To add MADCert to your project:
 
 -   Remove a Server Certificate
 
-        madcert.removeServerCert("test-server");
+        madcert.removeServerCert("test-server", "test-ca");
 
 -   Remove a User Certificate
 
-        madcert.removeUserCert("test-user");
+        madcert.removeUserCert("test-user", "test-ca");
+
+-   Retrieve a CA Certificate as JSON
+
+        madcert.caCertToJSON("test-root-ca");
+
+-   Retrieve a Server Certificate as JSON
+
+        madcert.serverCertToJSON("test-server", "test-ca");
+
+-   Retrieve a User Certificate as JSON
+
+        madcert.userCertToJSON("test-user", "test-ca");
 
 -  Convert name to a File Path Friendly Name
 
         madcert.normalizeName("Test 123");
         > 'test-123'
 
-
 ### Additional Node.js Options
 
 #### Certificate Storage Location
@@ -101,6 +112,7 @@ By default, the certs created by MADCert will be placed under a "pki" folder in
     -   Creation Options - these options can be used with any of the commands that create PKI files for CAs, servers, and users
     -   User Creation Options - these options can be used with the `user-create` command
     -   Server Creation Options - these options can be used with the `server-create` command
+    -   Print Options - these options can be used with the `ca-print`, `server-print`, and `user-print` commands
     -   Options - these options are not specific to any particular command
 
 
@@ -110,7 +122,7 @@ By default, the certs created by MADCert will be placed under a "pki" folder in
 
 -   Create an Intermediate CA (Root CA must exist)
 
-        npx madcert ca-create test-ca test-root-ca --common-name "Test CA" --org-unit "orgA" --org-unit "A123" --org "Some Organization" --country "US"
+        npx madcert ca-intermediate-create test-ca test-root-ca --common-name "Test CA" --org-unit "orgA" --org-unit "A123" --org "Some Organization" --country "US"
 
 -   Create a Server Certificate (CA must exist)
 
@@ -134,7 +146,7 @@ By default, the certs created by MADCert will be placed under a "pki" folder in
 
         npx madcert ca-list
 
--   List Server Cerficates
+-   List Server Certificates
 
         npx madcert server-list
 
@@ -154,6 +166,17 @@ By default, the certs created by MADCert will be placed under a "pki" folder in
 
         npx madcert user-remove test-user test-ca
 
+-   Print a CA Certificate
+
+        npx madcert ca-print test-ca
+
+-   Print a Server Certificate
+
+        npx madcert server-print test-server test-ca
+
+-   Print a User Certificate
+
+        npx madcert user-print test-user test-ca
 
 ### Additional CLI Options
 
@@ -167,6 +190,23 @@ By default, the certs created by MADCert will be placed under a "pki" folder in
 
 #### Arguments
 
--   `name` Name is used for the name of the directory under which PKI files are created. If the `--common-name` option is not used then `name` will also be used for the Common Name in the certificate subject.
--   `ca_name` CA name is used to identify the Certificate Authority to use when creating or removing users and servers.
--   `root_ca_name` When creating an intermediate Certificate Authority, `root_ca_name` identifies the root CA that issues the intermediate CA's certificate.
+
+|                    | Alias | Type    | Default Value | Description |
+| :---               | :----:| :----:  |    :----:     |        ---: |
+| `name`             |       | String  |               | Name is used for the name of the directory under which PKI files are created. If the `--common-name` option is not used then `name` will also be used for the Common Name in the certificate subject.   |
+| `ca-name`          |       | String  |               | CA name is used to identify the Certificate Authority to use when creating or removing users and servers.      |
+| `root_ca-name`     | `-r`  | String  |               | When creating an intermediate Certificate Authority, `root_ca_name` identifies the root CA that issues the intermediate CA's certificate.
+| `path`             | `-p`  | String  | '/pki'        | Base path for pki |
+| `common-name`      | `-n`  | String  |               | Common Name in the Distinguished Name |
+| `country`          | `-c`  | String  |               | Country |
+| `locality`         |       | String  |               | Locality|
+| `state`            | `-st` | String  |               | State|
+| `expired`          | `-e`  | Boolean |               | Create an expired certificate |
+| `org`              | `-o`  | Array   |               | Organization name. This option can be specified multiple times|
+| `org-unit`         | `-u`  | Array   |               | Organizational unit name. This option can be specified multiple times.|
+| `password`         | `-w`  | String  | 'changeme'    | Certificate password |
+| `subject-alt-dns`  | `-d`  | Array   |               | Create certificate with DNS subject alternative name. This option can be specified multiple times and only applies to server certs.|
+| `subject-alt-ip`   | `-i`  | Array   |               | Create certificate with IP subject alternative name. This option can be specified multiple times and only applies to server certs. |
+| `subject-alt-email`| `-m`  | Array   |               | Create certificate with rfc822/email subject alternative name. This option can be specified multiple times and only applies to server certs. |
+| `valid-from`       | `-f`  | Date    |               | Valid from date in ISO 8601 format |
+| `valid-to`         | `-t`  | Date    |               | Valid to date in ISO 8601 format|

package.json

@@ -1,6 +1,6 @@
 {
   "name": "madcert",
-  "version": "2.1.2",
+  "version": "2.5.0",
   "description": "Make a Development Cert",
   "engines": {
     "node": ">=10.16.0"
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "date-fns": "^2.19.0",
-    "fs-extra": "^9.1.0",
+    "fs-extra": "10.0.0",
     "lodash": "^4.17.21",
-    "node-forge": "^0.10.0",
-    "yargs": "^16.2.0"
+    "node-forge": "^1.3.0",
+    "yargs": "17.3.1"
   },
   "devDependencies": {
     "chai": "^4.3.4",
-    "mocha": "^8.3.2"
+    "mocha": "9.2.0"
   }
 }

src/ca.js

@@ -44,6 +44,9 @@ function buildCACert(keys, options, caCert = null) {
             digitalSignature: true,
             critical: true,
             cRLSign: true,
+            nonRepudiation: true,
+            keyEncipherment: true,
+            dataEncipherment: true
         },
         {
             name: 'subjectKeyIdentifier',
@@ -60,6 +63,10 @@ function buildCACert(keys, options, caCert = null) {
             name: 'extKeyUsage',
             serverAuth: true,
             critical: true,
+            clientAuth: true,
+            codeSigning: true,
+            emailProtection: true,
+            timeStamping: true
         });
     }
 

src/certToJSON.js

@@ -0,0 +1,76 @@
+const _ = require('lodash');
+const forge = require('node-forge');
+const fs = require('fs-extra');
+
+forge.options.usePureJavaScript = true;
+
+const extensionsFilter = [
+    'name',
+    'cA',
+    'critical',
+    'digitalSignature',
+    'nonRepudiation',
+    'keyEncipherment',
+    'dataEncipherment',
+    'keyAgreement',
+    'keyCertSign',
+    'cRLSign',
+    'encipherOnly',
+    'decipherOnly',
+    'subjectKeyIdentifier',
+    'altNames',
+    'serverAuth',
+    'clientAuth',
+    'codeSigning',
+    'emailProtection',
+    'timeStamping',
+    'client',
+    'server',
+    'email',
+    'objsign',
+    'reserved:',
+    'sslCA',
+    'emailCA',
+    'objCA',
+];
+
+/**
+ * 
+ * @param {Array} attributes 
+ * @returns {String} Distinguished name
+ */
+function attributesToDN(attributes){
+    let dn = '';
+    for (let i=0; i<attributes.length; i++){
+        const attribute = attributes[i];
+        dn += `${attribute.shortName}=${attribute.value}${i<attributes.length-1 ? ',' : ''}`
+    }
+    return dn;
+}
+
+/**
+ * 
+ * @param {String} path Path to pem certificate
+ * @param {Array} propertiesFilter Optional Array of Strings to filter response object properties by
+ * @returns {Object} Simplified JSON representation of pem certificate
+ */
+const certToJSON = function certToJSON(path, propertiesFilter) {
+    const crt = fs.readFileSync(path);
+    const forgeCrtObj = forge.pki.certificateFromPem(crt.toString());
+
+    const crtJSON = _.pick(forgeCrtObj, ['version', 'serialNumber', 'validity']);
+    crtJSON.subject = attributesToDN(forgeCrtObj.subject.attributes);
+    crtJSON.issuer = attributesToDN(forgeCrtObj.issuer.attributes);
+    crtJSON['signature algorithm'] = forge.oids[forgeCrtObj.signatureOid];
+
+    crtJSON.extensions = _.transform(forgeCrtObj.extensions, (result, value) => {
+        result.push(_.pick(value, extensionsFilter));
+    }, []);
+
+    if(propertiesFilter && propertiesFilter.length > 0)
+        return _.pick(crtJSON, propertiesFilter);
+    return crtJSON;
+}
+
+
+module.exports = certToJSON;

src/certs.js

@@ -1,5 +1,6 @@
 const fs = require('fs-extra');
 const _ = require('lodash');
+const path = require('path');
 
 const caDb = require('./caDatabase');
 const ca = require('./ca');
@@ -8,6 +9,7 @@ const user = require('./user');
 const utils = require('./utils');
 const normalizeName = utils.normalizeName;
 const createSubjectAttributes = require('./subjectAttributes');
+const certToJSON = require('./certToJSON');
 
 function jsonListCerts(basePath = 'pki/') {
     const certs = {};
@@ -80,6 +82,21 @@ function createCertDatabase(caName, { basePath = 'pki/', revokedCNs = [] } = {})
     );
 }
 
+function caCertToJSONWrapper(basePath, caName, propertiesFilter){
+    const certPath = basePath ? path.join(basePath, normalizeName(caName), 'ca/crt.pem') : path.join(__dirname, 'pki', normalizeName(caName), 'ca/crt.pem');
+    return certToJSON(certPath, propertiesFilter);
+}
+
+function serverCertToJSONWrapper(basePath, caName, serverName, propertiesFilter){
+    const certPath = basePath ? path.join(basePath, normalizeName(caName), 'servers', serverName, 'crt.pem') : path.join(__dirname, 'pki', normalizeName(caName), 'servers', serverName, 'crt.pem');
+    return certToJSON(certPath, propertiesFilter);
+}
+
+function userCertToJSONWrapper(basePath, caName, userName, propertiesFilter){
+    const certPath = basePath ? path.join(basePath, normalizeName(caName), 'users', userName, 'crt.pem') : path.join(__dirname, 'pki', normalizeName(caName), 'users', userName, 'crt.pem');
+    return certToJSON(certPath, propertiesFilter);
+}
+
 const certs = {
     createCACert: ca.createCACert,
     createIntermediateCACert: ca.createIntermediateCACert,
@@ -95,6 +112,9 @@ const certs = {
     createCertDatabase,
     normalizeName,
     createSubjectAttributes,
+    caCertToJSON: caCertToJSONWrapper,
+    serverCertToJSON: serverCertToJSONWrapper,
+    userCertToJSON: userCertToJSONWrapper,
 };
 
 module.exports = certs;

src/madcert.js

@@ -2,6 +2,7 @@
 
 const version = require('../package.json').version;
 
+const util = require('util')
 const yargs = require('yargs');
 const certs = require('./certs');
 
@@ -44,6 +45,15 @@ const argv = yargs
         executed = true;
         certs.listCACerts(argv.path);
     })
+    .command(
+        'ca-print <name>',
+        'print certificate authority details',
+        {},
+        function(argv) {
+            executed = true;
+            console.log(util.inspect(certs.caCertToJSON(argv.path, argv.name, argv.properties), {showHidden: false, depth: null}));
+        }
+    )
     .command(
         'ca-remove <name>',
         'remove a certificate authority and all associated users and servers',
@@ -59,6 +69,8 @@ const argv = yargs
             basePath: argv.path,
             commonName: argv['common-name'],
             country: argv.country,
+            locality: argv.locality,
+            state: argv.state,
             expired: argv.expired,
             organizations: argv.org,
             organizationalUnits: argv['org-unit'],
@@ -74,6 +86,15 @@ const argv = yargs
         executed = true;
         certs.listServerCerts(argv.path);
     })
+    .command(
+        'server-print <name> <ca_name>',
+        'print server certificate details',
+        {},
+        function(argv) {
+            executed = true;
+            console.log(util.inspect(certs.serverCertToJSON(argv.path, argv.ca_name, argv.name, argv.properties), {showHidden: false, depth: null}));
+        }
+    )
     .command('server-remove <name> <ca_name>', 'remove a server certificate', {}, function(argv) {
         executed = true;
         certs.removeServerCert(argv.name, argv.ca_name, argv.path);
@@ -84,6 +105,8 @@ const argv = yargs
             basePath: argv.path,
             commonName: argv['common-name'],
             country: argv.country,
+            locality: argv.locality,
+            state: argv.state,
             expired: argv.expired,
             rootCaName: argv['root-ca-name'],
             organizations: argv.org,
@@ -98,6 +121,15 @@ const argv = yargs
         executed = true;
         certs.listUserCerts(argv.path);
     })
+    .command(
+        'user-print <name> <ca_name>',
+        'print user certificate details',
+        {},
+        function(argv) {
+            executed = true;
+            console.log(util.inspect(certs.userCertToJSON(argv.path, argv.ca_name, argv.name, argv.properties), {showHidden: false, depth: null}));
+        }
+    )
     .command('user-remove <name> <ca_name>', 'remove a user certificates', {}, function(argv) {
         executed = true;
         certs.removeUserCert(argv.name, argv.ca_name, argv.path);
@@ -130,6 +162,13 @@ const argv = yargs
         default: 'US',
         requiresArg: true,
     })
+    .option('locality', {
+        describe: 'Locality',
+    })
+    .option('state', {
+        alias: 'st',
+        describe: 'State',
+    })
     .option('expired', {
         alias: 'e',
         describe: 'Create an expired certificate.',
@@ -199,6 +238,12 @@ const argv = yargs
         describe: 'Valid to date in ISO 8601 format.',
         requiresArg: true,
     })
+    .option('properties', {
+        describe: 'Properties to filter print result. This option can be specified multiple times.',
+        type: 'array',
+        default: [],
+        requiresArg: true,
+    })
     .alias('version', 'v')
     .alias('h', 'help')
     .conflicts('expired', 'valid-to')
@@ -206,6 +251,8 @@ const argv = yargs
     .help('help')
     .group('common-name', 'Creation Options:')
     .group('country', 'Creation Options:')
+    .group('locality', 'Creation Options:')
+    .group('state', 'Creation Options:')
     .group('expired', 'Creation Options:')
     .group('org-unit', 'Creation Options:')
     .group('org', 'Creation Options:')
@@ -218,6 +265,7 @@ const argv = yargs
     .group('password', 'Server Creation Options:')
     .group('subject-alt-dns', 'Server Creation Options:')
     .group('subject-alt-ip', 'Server Creation Options:')
+    .group('properties', 'Print Options:')
     .wrap(yargs.terminalWidth()).argv;
 
 if (!executed) {

src/server.js

@@ -66,9 +66,7 @@ function buildServerCert(keys, caName, caCert, localhost, options) {
         {
             name: 'keyUsage',
             digitalSignature: true,
-            nonRepudiation: true,
             keyEncipherment: true,
-            dataEncipherment: true,
             critical: true,
         },
         {
@@ -195,6 +193,10 @@ function createServerCert(
         return;
     }
 
+    // Adding a check for the common name to be populated
+    // with the name field if it is blank.
+    options.commonName = _.get(options, 'commonName', serverName);
+
     const serverCertPath = path.join(serverDir, '/crt.pem');
     const serverKeyPath = path.join(serverDir, '/key.pem');
     const serverP12Path = path.join(serverDir, '/bundle.p12');
@@ -275,7 +277,7 @@ function createServerCert(
                 expired ? 'expired ' : ''
             }server certificate was created and signed by ${caCertName}.`,
         };
-        console.error(success.message);
+        console.log(success.message);
         callback(null, success);
     } else {
         const err = {

src/subjectAttributes.js

@@ -33,6 +33,21 @@ function createSubjectAttributes(options) {
         });
     }
 
+    const l = _.get(options, 'locality');
+    if (l) {
+        attrs.push({
+            shortName: 'L',
+            value: l,
+        });
+    }
+
+    const st = _.get(options, 'state');
+    if(st) {
+        attrs.push({
+            shortName: 'ST',
+            value: st,
+        });
+    }
     return attrs;
 }
 

src/user.js

@@ -41,9 +41,7 @@ function buildUserCert(keys, options, caCert) {
         {
             name: 'keyUsage',
             digitalSignature: true,
-            nonRepudiation: true,
             keyEncipherment: true,
-            dataEncipherment: true,
             critical: true,
         },
         {

test/after.js

@@ -0,0 +1,5 @@
+const fs = require('fs-extra');
+
+after('Remove PKI directory', function() {
+    fs.removeSync(global.pkiPath);
+});

test/before.js

@@ -0,0 +1,9 @@
+const certs = require('..');
+const fs = require('fs-extra');
+
+before('Create PKI directory', function(done) {
+    global.pkiPath = `${__dirname}/pki`;
+    fs.ensureDirSync(global.pkiPath);
+    certs.createCACert('example', { basePath: global.pkiPath });
+    done();
+});

test/certToJSON.js

@@ -0,0 +1,19 @@
+const certToJSON = require('../src/certToJSON');
+const expect = require('chai').expect;
+const path = require('path');
+const util = require('util');
+
+describe('Testing certToJSON.js', function() {
+    it('Converts a PEM certificate to JSON', function() {
+        const certJSON = certToJSON(path.join(global.pkiPath, 'example/ca/crt.pem'));
+        expect(certJSON).to.be.an('object');
+        expect(certJSON).to.include.all.keys('version', 'serialNumber', 'validity', 'subject', 'issuer', 'signature algorithm', 'extensions');
+    });
+
+    it('Filters properties in returned JSON object', function(){
+        const propertiesArray = ['subject', 'issuer'];
+        const certJSON = certToJSON(path.join(global.pkiPath, 'example/ca/crt.pem'), propertiesArray);
+        expect(certJSON).to.be.an('object');
+        expect(Object.keys(certJSON)).to.deep.equal(propertiesArray)
+    });
+});

test/madcert.js

@@ -4,22 +4,12 @@ const fs = require('fs-extra');
 const path = require('path');
 const expect = require('chai').expect;
 
-const pkiPath = `${__dirname}/pki`;
-
 describe('Testing MADCert', function() {
-    before('Create PKI directory', function() {
-        fs.ensureDirSync(pkiPath);
-    });
-
-    after('Remove PKI directory', function() {
-        fs.removeSync(pkiPath);
-    });
-
     describe('CA Tests', function() {
         it('Create CA Cert', function(done) {
             try {
-                certs.createCACert('CA Cert', { basePath: pkiPath });
-                const created = fs.pathExistsSync(path.join(pkiPath, 'ca-cert/ca/crt.pem'));
+                certs.createCACert('CA Cert', { basePath: global.pkiPath });
+                const created = fs.pathExistsSync(path.join(global.pkiPath, 'ca-cert/ca/crt.pem'));
                 expect(created).to.be.true;
                 done();
             } catch (e) {
@@ -29,8 +19,8 @@ describe('Testing MADCert', function() {
 
         it('Create intermediate CA Cert', function(done) {
             try {
-                certs.createIntermediateCACert('CA Cert 2', 'CA Cert', { basePath: pkiPath });
-                const created = fs.pathExistsSync(path.join(pkiPath, 'ca-cert-2/ca/crt.pem'));
+                certs.createIntermediateCACert('CA Cert 2', 'CA Cert', { basePath: global.pkiPath });
+                const created = fs.pathExistsSync(path.join(global.pkiPath, 'ca-cert-2/ca/crt.pem'));
                 expect(created).to.be.true;
                 done();
             } catch (e) {
@@ -39,19 +29,19 @@ describe('Testing MADCert', function() {
         });
 
         it('List CA Certs', function() {
-            certs.listCACerts(pkiPath);
+            certs.listCACerts(global.pkiPath);
         });
 
         it('Remove CA Cert', function() {
-            certs.createCACert('CA Cert Test Removal', { basePath: pkiPath });
-            certs.removeCACert('CA Cert Test Removal', pkiPath);
+            certs.createCACert('CA Cert Test Removal', { basePath: global.pkiPath });
+            certs.removeCACert('CA Cert Test Removal', global.pkiPath);
         });
     });
 
     describe('Server Tests', function() {
         it('Create Server Cert including Root CA in bundle', function() {
             certs.createServerCert('Server', 'ca-cert-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
                 rootCaName: 'CA Cert',
             });
@@ -59,23 +49,43 @@ describe('Testing MADCert', function() {
 
         it('Create Server Cert excluding Root CA in bundle', function() {
             certs.createServerCert('Server 2', 'ca-cert-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
                 rootCaName: null,
             });
         });
 
+
+        it('Create Server Cert with locality and state', function(done) {
+            try {
+                certs.createServerCert('Server Locality and State', 'ca-cert-2', false, {
+                    locality: 'Baltimore',
+                    state: 'Maryland',
+                    basePath: global.pkiPath,
+                    expired: false,
+                    rootCaName: 'CA Cert',
+                });
+                const created = fs.pathExistsSync(
+                    path.join(global.pkiPath, 'ca-cert-2/servers/server-locality-and-state/crt.pem')
+                );
+                expect(created).to.be.true;
+                done();
+            } catch (e) {
+                done(e);
+            }
+        });
+
         it('Create Server Cert with start and expiration dates', function(done) {
             try {
                 certs.createServerCert('Server Valid From and To', 'ca-cert-2', false, {
                     validFrom: '2050-01-01T00:00:00',
                     validTo: '2051-01-01T00:00:00',
-                    basePath: pkiPath,
+                    basePath: global.pkiPath,
                     expired: false,
                     rootCaName: 'CA Cert',
                 });
                 const created = fs.pathExistsSync(
-                    path.join(pkiPath, 'ca-cert-2/servers/server-valid-from-and-to/crt.pem')
+                    path.join(global.pkiPath, 'ca-cert-2/servers/server-valid-from-and-to/crt.pem')
                 );
                 expect(created).to.be.true;
                 done();
@@ -89,12 +99,12 @@ describe('Testing MADCert', function() {
                 certs.createServerCert('Server Valid To before From', 'ca-cert-2', false, {
                     validFrom: '2051-01-01T00:00:00',
                     validTo: '2050-01-01T00:00:00',
-                    basePath: pkiPath,
+                    basePath: global.pkiPath,
                     expired: false,
                     rootCaName: 'CA Cert',
                 });
                 const created = fs.pathExistsSync(
-                    path.join(pkiPath, 'ca-cert-2/servers/server-valid-to-before-from/crt.pem')
+                    path.join(global.pkiPath, 'ca-cert-2/servers/server-valid-to-before-from/crt.pem')
                 );
                 expect(created).to.be.false;
                 done();
@@ -105,7 +115,7 @@ describe('Testing MADCert', function() {
 
         it('Create Expired Server Cert', function() {
             certs.createServerCert('Server 3', 'ca-cert-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: true,
                 rootCaName: 'CA Cert',
             });
@@ -113,23 +123,23 @@ describe('Testing MADCert', function() {
 
         it('Create Expired Server Cert for existing server', function() {
             certs.createServerCert('Server 2', 'ca-cert-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: true,
                 rootCaName: null,
             });
         });
 
         it('List Server Certs', function() {
-            certs.listServerCerts(pkiPath);
+            certs.listServerCerts(global.pkiPath);
         });
 
         it('Remove Server Cert', function() {
             certs.createServerCert('Server Test Removal', 'ca-cert-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
                 rootCaName: 'CA Cert',
             });
-            certs.removeServerCert('Server Test Removal', 'ca-cert-2', pkiPath);
+            certs.removeServerCert('Server Test Removal', 'ca-cert-2', global.pkiPath);
         });
     });
 
@@ -138,18 +148,18 @@ describe('Testing MADCert', function() {
         const caDir = 'user-tests-ca';
 
         before(function(done) {
-            certs.createCACert(caName, { basePath: pkiPath });
+            certs.createCACert(caName, { basePath: global.pkiPath });
             done();
         });
 
         after(function(done) {
-            certs.removeCACert(caName, pkiPath);
+            certs.removeCACert(caName, global.pkiPath);
             done();
         });
 
         it('Create User Cert', function(done) {
-            certs.createUserCert('User 1', caName, { basePath: pkiPath, expired: false });
-            const userCerts = certs.listUserCerts(pkiPath);
+            certs.createUserCert('User 1', caName, { basePath: global.pkiPath, expired: false });
+            const userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).to.contain('user-1');
             done();
         });
@@ -159,11 +169,29 @@ describe('Testing MADCert', function() {
                 certs.createUserCert('User Valid From and To', caName, {
                     validFrom: '2050-01-01T00:00:00',
                     validTo: '2051-01-01T00:00:00',
-                    basePath: pkiPath,
+                    basePath: global.pkiPath,
                     expired: false,
                 });
                 const created = fs.pathExistsSync(
-                    path.join(pkiPath, caDir, 'users/user-valid-from-and-to/crt.pem')
+                    path.join(global.pkiPath, caDir, 'users/user-valid-from-and-to/crt.pem')
+                );
+                expect(created).to.be.true;
+                done();
+            } catch (e) {
+                done(e);
+            }
+        });
+
+        it('Create User Cert with locality and state', function(done) {
+            try {
+                certs.createUserCert('User locality and state', caName, {
+                    locality: 'Baltimore',
+                    state: 'Maryland',
+                    basePath: global.pkiPath,
+                    expired: false,
+                });
+                const created = fs.pathExistsSync(
+                    path.join(global.pkiPath, caDir, 'users/user-locality-and-state/crt.pem')
                 );
                 expect(created).to.be.true;
                 done();
@@ -177,11 +205,11 @@ describe('Testing MADCert', function() {
                 certs.createUserCert('User Valid To before From', caName, {
                     validFrom: '2051-01-01T00:00:00',
                     validTo: '2050-01-01T00:00:00',
-                    basePath: pkiPath,
+                    basePath: global.pkiPath,
                     expired: false,
                 });
                 const created = fs.pathExistsSync(
-                    path.join(pkiPath, caDir, 'users/user-valid-to-before-from/crt.pem')
+                    path.join(global.pkiPath, caDir, 'users/user-valid-to-before-from/crt.pem')
                 );
                 expect(created).to.be.false;
                 done();
@@ -191,42 +219,42 @@ describe('Testing MADCert', function() {
         });
 
         it('Create Expired User Cert', function(done) {
-            certs.createUserCert('User 2', caName, { basePath: pkiPath, expired: true });
-            const userCerts = certs.listUserCerts(pkiPath);
+            certs.createUserCert('User 2', caName, { basePath: global.pkiPath, expired: true });
+            const userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).to.contain('user-2');
             done();
         });
 
         it('Create Expired User Cert for existing User', function() {
-            certs.createUserCert('User 1', caName, { basePath: pkiPath, expired: true });
+            certs.createUserCert('User 1', caName, { basePath: global.pkiPath, expired: true });
         });
 
         it('List User Certs', function(done) {
-            const userCerts = certs.listUserCerts(pkiPath);
+            const userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).to.not.be.empty;
             done();
         });
 
         it('Create User Cert with rfc822 Subject Alternative', function(done) {
             certs.createUserCert('User 3', caName, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
                 subjectAltEmailNames: ['[email protected]'],
             });
-            const userCerts = certs.listUserCerts(pkiPath);
+            const userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).to.contain('user-3');
             done();
         });
 
         it('Remove User Cert', function(done) {
             certs.createUserCert('User Test Removal', caName, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
             });
-            let userCerts = certs.listUserCerts(pkiPath);
+            let userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).to.contain('user-test-removal');
-            certs.removeUserCert('User Test Removal', caName, pkiPath);
-            userCerts = certs.listUserCerts(pkiPath);
+            certs.removeUserCert('User Test Removal', caName, global.pkiPath);
+            userCerts = certs.listUserCerts(global.pkiPath);
             expect(userCerts).not.to.contain('user-test-removal');
             done();
         });
@@ -242,19 +270,19 @@ describe('Testing MADCert', function() {
 
         it('when CA, Servers, and Users Exist', function() {
             this.timeout(newTimeout); //this test creates 4 certs, so we allow 4x the time
-            certs.createCACert('CA Cert List', { basePath: pkiPath });
-            certs.createIntermediateCACert('CA Cert List 2', 'CA Cert List', { basePath: pkiPath });
+            certs.createCACert('CA Cert List', { basePath: global.pkiPath });
+            certs.createIntermediateCACert('CA Cert List 2', 'CA Cert List', { basePath: global.pkiPath });
             certs.createServerCert('Server List', 'ca-cert-list-2', false, {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
                 rootCaName: 'CA Cert List',
             });
             certs.createUserCert('User List 1', 'ca-cert-list-2', {
-                basePath: pkiPath,
+                basePath: global.pkiPath,
                 expired: false,
             });
 
-            const list = certs.listCerts(pkiPath);
+            const list = certs.listCerts(global.pkiPath);
             expect(list.ca).to.not.be.null;
 
             const caCert = _.find(list.ca, { name: 'ca-cert-list' });
@@ -269,20 +297,20 @@ describe('Testing MADCert', function() {
         });
 
         it('when none exist', function() {
-            fs.removeSync(pkiPath);
+            fs.removeSync(global.pkiPath);
 
-            const list = certs.listCerts(pkiPath);
+            const list = certs.listCerts(global.pkiPath);
             expect(list.ca).to.be.undefined;
         });
     });
 
     describe('Cert Database Tests', function() {
         before('', function() {
-            certs.createCACert('ca cert db', { basePath: pkiPath });
+            certs.createCACert('ca cert db', { basePath: global.pkiPath });
         });
 
         it('Create Cert DB', function() {
-            certs.createCertDatabase('ca cert db', { basePath: pkiPath });
+            certs.createCertDatabase('ca cert db', { basePath: global.pkiPath });
         });
     });