如何为HTTPS Node.js服务器使用自签名证书？

如何为HTTPS Node.js服务器使用自签名证书？ 更新（2018年11月）：您是否 需要 自签名证书？

还是真正的证书能使工作做得更好？您考虑过其中任何一个吗？

• 让我们通过Greenlock.js进行加密
• 让我们通过https://greenlock.domains加密
• Localhost中继服务，例如https://telebit.cloud

（注意：“让我们加密”还可以将证书颁发给专用网络）

ScreenCast

https://coolaj86.com/articles/how-to-create-a-csr-for-https-tls-ssl-rsa-
pems/

完整的工作示例

• 创建证书
• 运行node.js服务器
• node.js客户端中没有警告或错误
• cURL中没有警告或错误

https://github.com/coolaj86/nodejs-self-signed-certificate-
example

使用

localhost.greenlock.domains

作为一个例子（它指向127.0.0.1）：

server.js

'use strict';var https = require('https')  , port = process.argv[2] || 8043  , fs = require('fs')  , path = require('path')  , server  , options  ;require('ssl-root-cas')  .inject()  .addFile(path.join(__dirname, 'server', 'my-private-root-ca.cert.pem'))  ;options = {  // this is onLY the PRIVATE KEY  key: fs.readFileSync(path.join(__dirname, 'server', 'privkey.pem'))  // You DO NOT specify `ca`, that's only for peer authentication//, ca: [ fs.readFileSync(path.join(__dirname, 'server', 'my-private-root-ca.cert.pem'))]  // This should contain both cert.pem AND chain.pem (in that order) , cert: fs.readFileSync(path.join(__dirname, 'server', 'fullchain.pem'))};function app(req, res) {  res.setHeader('Content-Type', 'text/plain');  res.end('Hello, encrypted world!');}server = https.createServer(options, app).listen(port, function () {  port = server.address().port;  console.log('Listening on https://127.0.0.1:' + port);  console.log('Listening on https://' + server.address().address + ':' + port);  console.log('Listening on https://localhost.greenlock.domains:' + port);});

client.js

'use strict';var https = require('https')  , fs = require('fs')  , path = require('path')  , ca = fs.readFileSync(path.join(__dirname, 'client', 'my-private-root-ca.cert.pem'))  , port = process.argv[2] || 8043  , hostname = process.argv[3] || 'localhost.greenlock.domains'  ;var options = {  host: hostname, port: port, path: '/', ca: ca};options.agent = new https.Agent(options);https.request(options, function(res) {  res.pipe(process.stdout);}).end();

以及制作证书文件的脚本：

make-certs.sh

#!/bin/bashFQDN=# make directories to work frommkdir -p server/ client/ all/# Create your very own Root Certificate Authorityopenssl genrsa   -out all/my-private-root-ca.privkey.pem   2048# Self-sign your Root Certificate Authority# Since this is private, the details can be as bogus as you likeopenssl req   -x509   -new   -nodes   -key all/my-private-root-ca.privkey.pem   -days 1024   -out all/my-private-root-ca.cert.pem   -subj "/C=US/ST=Utah/L=Provo/O=ACME Signing Authority Inc/CN=example.com"# Create a Device Certificate for each domain,# such as example.com, *.example.com, awesome.example.com# NOTE: You MUST match CN to the domain name or ip address you want to useopenssl genrsa   -out all/privkey.pem   2048# Create a request from your Device, which your Root CA will signopenssl req -new   -key all/privkey.pem   -out all/csr.pem   -subj "/C=US/ST=Utah/L=Provo/O=ACME Tech Inc/CN=${FQDN}"# Sign the request from Device with your Root CAopenssl x509   -req -in all/csr.pem   -CA all/my-private-root-ca.cert.pem   -CAkey all/my-private-root-ca.privkey.pem   -CAcreateserial   -out all/cert.pem   -days 500# Put things in their proper placersync -a all/{privkey,cert}.pem server/cat all/cert.pem > server/fullchain.pem         # we have no intermediates in this casersync -a all/my-private-root-ca.cert.pem server/rsync -a all/my-private-root-ca.cert.pem client/# create DER format crt for iOS Mobile Safari, etcopenssl x509 -outform der -in all/my-private-root-ca.cert.pem -out client/my-private-root-ca.crt

例如：

bash make-certs.sh 'localhost.greenlock.domains'

希望这能把棺材钉在棺材上。

还有更多说明：https : //github.com/coolaj86/node-ssl-root-
cas/wiki/Painless-Self-Signed-Certificates-in-
node.js

在iOS Mobile Safari上安装私人证书

您需要创建扩展名为.crt的DER格式的根ca证书副本：

# create DER format crt for iOS Mobile Safari, etcopenssl x509 -outform der -in all/my-private-root-ca.cert.pem -out client/my-private-root-ca.crt

然后，您可以简单地通过Web服务器提供该文件。单击链接时，将询问您是否要安装证书。

有关如何工作的示例，可以尝试安装MIT的证书颁发机构：https :
//ca.mit.edu/mitca.crt

相关例子

• https://github.com/coolaj86/nodejs-ssl-example
• https://github.com/coolaj86/nodejs-ssl-trusted-peer-example
• https://github.com/coolaj86/node-ssl-root-cas
• https://github.com/coolaj86/nodejs-https-sni-vhost-example
  • （在同一服务器上具有SSL的多个虚拟主机）
• https://telebit.cloud
  • （获取可以使用TODAY在本地主机上进行测试的REAL SSL证书）