如何对 HTTPS Node.js 服务器使用自签名证书？

2024-01-23

我已经开始为 API 编写一个包装器，该 API 要求所有请求都通过 HTTPS 进行。我不想在开发和测试实际 API 时向其发出请求，而是想在本地运行自己的服务器来模拟响应。

我对如何生成创建 HTTPS 服务器并向其发送请求所需的证书感到困惑。

我的服务器看起来像这样：

var options = {
  key: fs.readFileSync('./key.pem'),
  cert: fs.readFileSync('./cert.pem')
};

https.createServer(options, function(req, res) {
  res.writeHead(200);
  res.end('OK\n');
}).listen(8000);

pem 文件是通过以下命令生成的：

openssl genrsa 1024 > key.pem
openssl req -x509 -new -key key.pem > cert.pem

请求看起来像这样：

var options = {
  host: 'localhost',
  port: 8000,
  path: '/api/v1/test'
};

https.request(options, function(res) {
  res.pipe(process.stdout);
}).end();

通过这个设置我得到Error: DEPTH_ZERO_SELF_SIGNED_CERT，所以我想我需要添加一个ca请求的选项。

所以我的问题是我应该如何生成以下内容：

服务器key?
服务器cert?
The ca对于请求？

我已经阅读了一些有关使用 openssl 生成自签名证书的内容，但似乎无法理解它并弄清楚在节点代码中的何处使用哪些密钥和证书。

Update

API 提供了一个 CA 证书来代替默认证书。以下代码使用他们的证书工作，这就是我想在本地重现的代码。

var ca = fs.readFileSync('./certificate.pem');

var options = {
  host: 'example.com',
  path: '/api/v1/test',
  ca: ca
};
options.agent = new https.Agent(options);

https.request(options, function(res) {
  res.pipe(process.stdout);
}).end();

更新（2018 年 11 月）：你need自签名证书？

或者真正的证书会让工作做得更好吗？您考虑过其中任何一个吗？

让我们通过以下方式加密Greenlock.js https://git.coolaj86.com/coolaj86/greenlock-express.js
让我们通过以下方式加密https://greenlock.domains https://greenlock.domains
本地主机中继服务，例如https://telebit.cloud https://telebit.cloud

（注：Let's Encrypt还可以向私有网络颁发证书）

投屏

https://coolaj86.com/articles/how-to-create-a-csr-for-https-tls-ssl-rsa-pems/ https://coolaj86.com/articles/how-to-create-a-csr-for-https-tls-ssl-rsa-pems/

完整的工作示例

创建证书
运行node.js服务器
Node.js 客户端中没有警告或错误
cURL 中没有警告或错误

https://github.com/coolaj86/nodejs-self-signed-certificate-example https://github.com/coolaj86/nodejs-self-signed-certificate-example

Using localhost.greenlock.domains例如（它指向 127.0.0.1）：

服务器.js

'use strict';

var https = require('https')
  , port = process.argv[2] || 8043
  , fs = require('fs')
  , path = require('path')
  , server
  , options
  ;

require('ssl-root-cas')
  .inject()
  .addFile(path.join(__dirname, 'server', 'my-private-root-ca.cert.pem'))
  ;

options = {
  // this is ONLY the PRIVATE KEY
  key: fs.readFileSync(path.join(__dirname, 'server', 'privkey.pem'))
  // You DO NOT specify `ca`, that's only for peer authentication
//, ca: [ fs.readFileSync(path.join(__dirname, 'server', 'my-private-root-ca.cert.pem'))]
  // This should contain both cert.pem AND chain.pem (in that order) 
, cert: fs.readFileSync(path.join(__dirname, 'server', 'fullchain.pem'))
};


function app(req, res) {
  res.setHeader('Content-Type', 'text/plain');
  res.end('Hello, encrypted world!');
}

server = https.createServer(options, app).listen(port, function () {
  port = server.address().port;
  console.log('Listening on https://127.0.0.1:' + port);
  console.log('Listening on https://' + server.address().address + ':' + port);
  console.log('Listening on https://localhost.greenlock.domains:' + port);
});

客户端.js

'use strict';

var https = require('https')
  , fs = require('fs')
  , path = require('path')
  , ca = fs.readFileSync(path.join(__dirname, 'client', 'my-private-root-ca.cert.pem'))
  , port = process.argv[2] || 8043
  , hostname = process.argv[3] || 'localhost.greenlock.domains'
  ;

var options = {
  host: hostname
, port: port
, path: '/'
, ca: ca
};
options.agent = new https.Agent(options);

https.request(options, function(res) {
  res.pipe(process.stdout);
}).end();

以及制作证书文件的脚本：

制作证书.sh

#!/bin/bash
FQDN=$1

# make directories to work from
mkdir -p server/ client/ all/

# Create your very own Root Certificate Authority
openssl genrsa \
  -out all/my-private-root-ca.privkey.pem \
  2048

# Self-sign your Root Certificate Authority
# Since this is private, the details can be as bogus as you like
openssl req \
  -x509 \
  -new \
  -nodes \
  -key all/my-private-root-ca.privkey.pem \
  -days 1024 \
  -out all/my-private-root-ca.cert.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=ACME Signing Authority Inc/CN=example.com"

# Create a Device Certificate for each domain,
# such as example.com, *.example.com, awesome.example.com
# NOTE: You MUST match CN to the domain name or ip address you want to use
openssl genrsa \
  -out all/privkey.pem \
  2048

# Create a request from your Device, which your Root CA will sign
openssl req -new \
  -key all/privkey.pem \
  -out all/csr.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=ACME Tech Inc/CN=${FQDN}"

# Sign the request from Device with your Root CA
openssl x509 \
  -req -in all/csr.pem \
  -CA all/my-private-root-ca.cert.pem \
  -CAkey all/my-private-root-ca.privkey.pem \
  -CAcreateserial \
  -out all/cert.pem \
  -days 500

# Put things in their proper place
rsync -a all/{privkey,cert}.pem server/
cat all/cert.pem > server/fullchain.pem         # we have no intermediates in this case
rsync -a all/my-private-root-ca.cert.pem server/
rsync -a all/my-private-root-ca.cert.pem client/

# create DER format crt for iOS Mobile Safari, etc
openssl x509 -outform der -in all/my-private-root-ca.cert.pem -out client/my-private-root-ca.crt

例如：

bash make-certs.sh 'localhost.greenlock.domains'

希望这能为这件事钉上棺材。

还有更多解释：https://github.com/coolaj86/node-ssl-root-cas/wiki/Painless-Self-Signed-Certificates-in-node.js https://github.com/coolaj86/node-ssl-root-cas/wiki/Painless-Self-Signed-Certificates-in-node.js

在 iOS Mobile Safari 上安装私有证书

您需要创建 DER 格式的根 ca 证书的副本，扩展名为 .crt：

# create DER format crt for iOS Mobile Safari, etc
openssl x509 -outform der -in all/my-private-root-ca.cert.pem -out client/my-private-root-ca.crt

然后您可以简单地通过您的网络服务器提供该文件。单击该链接时，系统会询问您是否要安装证书。

有关其工作原理的示例，您可以尝试安装 MIT 的证书颁发机构：https://ca.mit.edu/mitca.crt https://ca.mit.edu/mitca.crt