码迷,mamicode.com
首页 > Web开发 > 详细

[转]用Node.js创建自签名的HTTPS服务器

时间:2015-07-28 17:45:13      阅读:176      评论:0      收藏:0      [点我收藏+]

标签:

用Node.js创建自签名的HTTPS服务器

  1. 创建自己的CA机构
  2. 创建服务器端证书
  3. 创建客户端证书
  4. 将证书打包

创建自己的CA机构

  • 为CA生成私钥

openssl genrsa -out ca-key.pem -des 1024

  • 通过CA私钥生成CSR

openssl req -new -key ca-key.pem -out ca-csr.pem

  • 通过CSR文件和私钥生成CA证书

openssl x509 -req -in ca-csr.pem -signkey ca-key.pem -out ca-cert.pem

可能会遇到的问题

你需要root或者admin的权限 Unable to load config info from /user/local/ssl/openssl.cnf 对于这个问题,你可以从网上下载一份正确的openssl.cnf文件, 然后set OPENSSL_CONF=openssl.cnf文件的本地路径

创建服务器端证书

  • 为服务器生成私钥

openssl genrsa -out server-key.pem 1024

  • 利用服务器私钥文件服务器生成CSR

openssl req -new -key server-key.pem -config openssl.cnf -out server-csr.pem

这一步非常关键,你需要指定一份openssl.cnf文件。可以用这个

[req]  
    distinguished_name = req_distinguished_name  
    req_extensions = v3_req  
  
    [req_distinguished_name]  
    countryName = Country Name (2 letter code)  
    countryName_default = CN  
    stateOrProvinceName = State or Province Name (full name)  
    stateOrProvinceName_default = BeiJing  
    localityName = Locality Name (eg, city)  
    localityName_default = YaYunCun  
    organizationalUnitName  = Organizational Unit Name (eg, section)  
    organizationalUnitName_default  = Domain Control Validated  
    commonName = Internet Widgits Ltd  
    commonName_max  = 64  
  
    [ v3_req ]  
    # Extensions to add to a certificate request  
    basicConstraints = CA:FALSE  
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment  
    subjectAltName = @alt_names  
  
    [alt_names]  
    #注意这个IP.1的设置,IP地址需要和你的服务器的监听地址一样
    IP.1 = 127.0.0.1
  • 通过服务器私钥文件和CSR文件生成服务器证书

openssl x509 -req -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -in server-csr.pem -out server-cert.pem -extensions v3_req -extfile openssl.cnf

创建客户端证书

  • 生成客户端私钥

openssl genrsa -out client-key.pem

  • 利用私钥生成CSR

openssl req -new -key client-key.pem -out client-csr.pem

  • 生成客户端证书

openssl x509 -req -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -in client-csr.pem -out client-cert.pem

HTTPS 服务器代码

var https = require(‘https‘);
var fs = require(‘fs‘);

var options = {
    key: fs.readFileSync(‘./keys/server-key.pem‘),
    ca: [fs.readFileSync(‘./keys/ca-cert.pem‘)],
    cert: fs.readFileSync(‘./keys/server-cert.pem‘)
};

https.createServer(options,function(req,res){
    res.writeHead(200);
    res.end(‘hello world\n‘);
}).listen(3000,‘127.0.0.1‘);

HTTPS 客户端代码

var https = require(‘https‘);
var fs = require(‘fs‘);

var options = {
    hostname:‘127.0.0.1‘,
    port:3000,
    path:‘/‘,
    method:‘GET‘,
    key:fs.readFileSync(‘./keys/client-key.pem‘),
    cert:fs.readFileSync(‘./keys/client-cert.pem‘),
    ca: [fs.readFileSync(‘./keys/ca-cert.pem‘)],
    agent:false
};

options.agent = new https.Agent(options);
var req = https.request(options,function(res){
console.log("statusCode: ", res.statusCode);
  console.log("headers: ", res.headers);
    res.setEncoding(‘utf-8‘);
    res.on(‘data‘,function(d){
        console.log(d);
    })
});

req.end();

req.on(‘error‘,function(e){
    console.log(e);
})

将证书打包

  • 打包服务器端证书

openssl pkcs12 -export -in server-cert.pem -inkey server-key.pem -certfile ca-cert.pem -out server.pfx

  • 打包客户端证书

openssl pkcs12 -export -in client-cert.pem -inkey client-key.pem -certfile ca-cert.pem -out client.pfx

服务器端代码

var https = require(‘https‘);
var fs = require(‘fs‘);

var options = {
    pfx:fs.readFileSync(‘./keys/server.pfx‘),
    passphrase:‘your password‘
};

https.createServer(options,function(req,res){
    res.writeHead(200);
    res.end(‘hello world\n‘);
}).listen(3000,‘127.0.0.1‘);

客户端代码

var https = require(‘https‘);
var fs = require(‘fs‘);

var options = {
    hostname:‘127.0.0.1‘,
    port:3000,
    path:‘/‘,
    method:‘GET‘,
    pfx:fs.readFileSync(‘./keys/server.pfx‘),
    passphrase:‘your password‘,
    agent:false
};

options.agent = new https.Agent(options);
var req = https.request(options,function(res){
console.log("statusCode: ", res.statusCode);
  console.log("headers: ", res.headers);
    res.setEncoding(‘utf-8‘);
    res.on(‘data‘,function(d){
        console.log(d);
    })
});

req.end();

req.on(‘error‘,function(e){
    console.log(e);
})


原文地址:https://cnodejs.org/topic/54745ac22804a0997d38b32d

[转]用Node.js创建自签名的HTTPS服务器

标签:

原文地址:http://www.cnblogs.com/zhutty/p/4682822.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!