Civi Settings/Key Generator

This script will generate "civicrm.settings.php" options for some crypto keys.

HTML

Copy this configuration to <code>civicrm.settings.php</code>:

<hr/>

<pre>
/**
 * If credentials are stored in the database, the CIVICRM_CRED_KEYS will be
 * used to encrypt+decrypt them. This is a space-delimited list of keys (ordered by
 * priority). Put the preferred key first. Any old/deprecated keys may be
 * listed after.
 *
 * More info at https://docs.civicrm.org/sysadmin/en/latest/setup/cred-key/
 */
if (!defined('CIVICRM_CRED_KEYS') ) {
  define( 'CIVICRM_CRED_KEYS', '<span id="cred-keys"></span>');
}

/**
 * The signing key is used to generate and verify shareable tokens.
 *
 * This is a space-delimited list of keys (ordered by priority). Put the preferred
 * key first. Any old/deprecated keys may be listed after.
 */
if (!defined('CIVICRM_SIGN_KEYS') ) {
  define( 'CIVICRM_SIGN_KEYS', '<span id="sign-keys"></span>');
}
</pre>

JavaScript

function generate256() {
  // Docs: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
  const subtle = window.crypto.subtle;
  return subtle.generateKey(
    {name:"AES-CBC",length:256},
    true,
    ["encrypt"]
  ).then(function(key) {
    return subtle.exportKey("jwk", key);
  }).then(function(jwk) {
    return jwk.k;
  });
}

// These are both hkdf-sha256, which
// is handy for letting the user hack
// at the output. We just need any string
// with 256 bits worth of entropy
// (~43 base64 chars).

generate256().then(function(str) {
  document.getElementById('cred-keys').innerText = 
    'aes-cbc:hkdf-sha256:' + str;
});

generate256().then(function(str) {
  document.getElementById('sign-keys').innerText = 
    'jwt-hs256:hkdf-sha256:' + str;
});