MacOS and Windows Self-Signed Certificate for Silent Printing
Diana W
Tres Finocchiaro
--
You received this message because you are subscribed to the Google Groups "qz-print" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qz-print+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/qz-print/310fa6ee-b10e-44bd-9a1e-1378786eca39n%40googlegroups.com.
Diana W
I created my own certificates locally on the Mac
openssl genrsa -out private-key.pem 2048
openssl req -new -key private-key.pem -out cert.csr
openssl x509 -req -days 3650 -in cert.csr -signkey private-key.pem -out digital-certificate.pem
It created these files
cert.csr
digital-certificate.pem
digital-certificate.txt (I copied the .pem file to this .txt file)
private-key.pem
I updated my application to use the new digitial-certificate.txt and private-key.pem files but QZ Tray prompts me every time to Allow with my self signed certs.
I'll show you my code here if you need it.
JavaScript
<button type="button" onclick="testPrint()">Test Zebra Print</button>
<script src="/js/qz-tray.js"></script>
<script>
window.addEventListener('load', function() {
console.log('QZ INIT START');
qz.security.setCertificatePromise(function(resolve, reject) {
fetch("/myfolder-for-qz-public-key/digital-certificate.txt", {
cache: "no-store",
headers: { "Content-Type": "text/plain" },
credentials: "include"
})
.then(function(resp) {
console.log("CERT FETCH STATUS:", resp.status, resp.statusText);
return resp.ok ? resp.text() : Promise.reject(resp.status + " " + resp.statusText);
})
.then(function(cert) {
console.log("CERT LENGTH:", cert.length);
console.log("CERT START:", cert.substring(0, 120));
console.log("FULL CERT:\n" + cert);
resolve(cert);
})
.catch(function(err) {
console.error("CERT FETCH ERROR:", err);
reject(err);
});
});
qz.security.setSignatureAlgorithm("SHA512");
qz.security.setSignaturePromise(function(toSign) {
return function(resolve, reject) {
fetch("/myfolder-for-qz-public-key/sign-message.php?request=" + encodeURIComponent(toSign), {
cache: "no-store",
headers: { "Content-Type": "text/plain" },
credentials: "include"
})
.then(function(resp) {
return resp.ok ? resp.text() : Promise.reject(resp.status + " " + resp.statusText);
})
.then(function(signature) {
console.log("SIGNATURE LENGTH:", signature.length);
console.log("SIGNATURE START:", signature.substring(0, 80));
resolve(signature);
})
.catch(function(err) {
console.error("SIGNATURE ERROR:", err);
reject(err);
});
};
});
});
async function testPrint() {
console.log('TESTPRINT ENTERED');
try {
console.log('IS ACTIVE BEFORE:', qz.websocket.isActive());
if (!qz.websocket.isActive()) {
console.log('CONNECTING FROM TESTPRINT');
await qz.websocket.connect({ usingSecure: false });
console.log('CONNECTED FROM TESTPRINT');
}
console.log('BEFORE GET VERSION');
const version = await qz.api.getVersion();
console.log('QZ VERSION:', version);
console.log('BEFORE FIND PRINTER');
const printer = await qz.printers.find("Zebra Technologies ZTC ZD421CN-300dpi ZPL");
console.log('MATCHED PRINTER:', printer);
console.log('BEFORE CONFIG CREATE');
const config = qz.configs.create(printer, { forceRaw: true });
// TEST CENTERED
const data = [
'^XA\n',
'^PW812\n', // set label width
'^FO0,50\n', // start at left edge
'^FB812,1,0,C,0\n', // full width, CENTER aligned
'^A0N,50,50\n',
'^FDHELLO QZ^FS\n',
'^XZ\n'
];
console.log('BEFORE PRINT');
await qz.print(config, data);
console.log('PRINT SENT');
} catch (err) {
console.error('TESTPRINT ERROR:', err);
}
}
</script>
sign-message.php
<?php
declare(strict_types=1);
header('Content-Type: text/plain; charset=utf-8');
$keyPath = $myfolder-for-private-key-pem . '/private-key.pem';
$request = $_GET['request'] ?? '';
if ($request === '') {
http_response_code(400);
echo 'Missing request';
exit;
}
$keyContents = @file_get_contents($keyPath);
if ($keyContents === false) {
http_response_code(500);
echo 'Unable to read private key';
exit;
}
$privateKey = openssl_pkey_get_private($keyContents);
if ($privateKey === false) {
http_response_code(500);
echo 'Invalid private key';
exit;
}
$signature = null;
$ok = openssl_sign($request, $signature, $privateKey, 'sha512');
if (!$ok || !$signature) {
http_response_code(500);
echo 'Error signing message';
exit;
}
echo base64_encode($signature);
Best regards,
Diana
Tres Finocchiaro
I created my own certificates locally on the Mac
encodeURIComponent(toSign)
To view this discussion visit https://groups.google.com/d/msgid/qz-print/78eef8fa-6070-4583-a14d-0e7001989164n%40googlegroups.com.
Diana W
>>>>You wrote
encodeURIComponent(toSign)
digital-certificate.txt
private-key.pem
You said I'll have to import the new one into QZ Tray. Are you saying to do that with encodeURIComponent(toSign)? That's what I've been doing. I've updated the files in my application and restarted QZ Tray many many times. I've even started over with a more complex solution using an intermediate
I am not an expert in certs, but I've spent several days trying different things. Based on the example you gave https://qz.io/docs/signing-examples#javascript, I could see I needed an intermediate cert.
I added these to my Keychain Access System Certificates
My QZ Root CA
My QZ Intermediate CA
QZ Tray Signing Cert
I added this to my Keychain Access Login Certificates
mydomain.xxx.xxx.xxx <--- using my real domain
when I expand mydomain.xxx.xxx.xxx , It shows QZ Signing Certificate
However, it seems to not use that if keep these
digital-certificate.txt
intermediate.cnf
intermediate.crt
intermediate.csr
intermediate.key
intermediate.srl
private-key.pem
qz-leaf.cnf
qz-leaf.crt
qz-leaf.csr
qz-leaf.key
qz-leaf.nopass.key
qz-leaf.p12
rootCA.cnf
rootCA.crt
rootCA.key
rootCA.srl
Diana W
encodeURIComponent(toSign)
Tres Finocchiaro
I added these to my Keychain Access System Certificates
- The demo cert is 100% functional, you just have to copy it to the machines you want to use it with. We don't spell these instructions out in our tutorial because we want to encourage people to pay for commercial support instead, but this is 100% doable with the DEMO cert we create. 99% of the time you can copy override.crt to C:\Program Files\QZ Tray and you're good to go.
- The intermediate certificate is only needed if using OUR certs. Adding all of the trouble of an intermediate certificate is FAR too much work and serves NO benefit. We do this because of our deployment size. Please don't do this.
- Once you get everything working on your machine, deploying that DEMO cert is the only step you should be focused on.
To view this discussion visit https://groups.google.com/d/msgid/qz-print/3553fd09-f724-4d58-935d-e94ee482aa40n%40googlegroups.com.
Diana W
Tres Finocchiaro
When you say "copy it", are you referring to copying the /Applications/QZ Tray.app/Contents/Resources/override.crt to the other clients (Windows) into C:\Program Files\QZ Tray? Does this also mean I do not have to generate the demo certs on the other clients? Just need the override.crt?
To view this discussion visit https://groups.google.com/d/msgid/qz-print/7040fd28-9164-44c9-9724-c7d0c37eea0fn%40googlegroups.com.
Diana W
Diana W
Diana W
curl -i "https://your-docker-host/qz-public-key/sign-message.php?request=test"