用Node.js创建自签名的HTTPS服务器

用Node.js创建自签名的HTTPS服务器

创建自己的CA机构

openssl genrsa -out c:/myca/ca-key.pem -des 1024

openssl req -new -key c:/myca/ca-key.pem -out c:/myca/ca-csr.pem

openssl x509 -days 7000 -req -in c:/myca/ca-csr.pem -signkey c:/myca/ca-key.pem -out c:/myca/ca-cert.pem

-days

创建服务器端证书

openssl genrsa -out c:/myca/server-key.pem 1024

openssl.cnf

注：确保req_distinguished_name下没有 0.xxx 的标签，有的话把0.xxx的0. 去掉

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = CN
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = ShangHai
localityName = Locality Name (eg, city)
localityName_default = ShangHai
organizationalUnitName  = Organizational Unit Name (eg, section)
organizationalUnitName_default  = src123
commonName = www.src123.com
commonName_max  = 64

# 新增最后一行内容 subjectAltName = @alt_names（前2行默认存在）
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

# 新增 alt_names,注意括号前后的空格，DNS.x 的数量可以自己加
[alt_names]
#注意这个IP.1的设置，IP地址需要和你的服务器的监听地址一样
IP.1 = 127.0.0.1
IP.2 = 192.168.0.125
DNS.1 = www.src123.com

[root@localhost]#mkdir -p demoCA/{certs,crl,newcerts,private}
[root@localhost]# touch demoCA/index.txt
[root@localhost]#echo 00 > demoCA/serial

openssl req -new -key c:/myca/server-key.pem -config c:/myca/openssl.cnf -out c:/myca/server-csr.pem

openssl x509 -days 7000 -req -CA c:/myca/ca-cert.pem -CAkey c:/myca/ca-key.pem -CAcreateserial -in c:/myca/server-csr.pem -out c:/myca/server-cert.pem -extensions v3_req -extfile c:/myca/openssl.cnf

openssl pkcs12 -export -in c:/myca/server-cert.pem -inkey c:/myca/server-key.pem -certfile c:/myca/ca-cert.pem -out c:/myca/server.pfx

创建客户端证书

openssl genrsa -out c:/myca/client-key.pem

openssl req -new -key c:/myca/client-key.pem -out c:/myca/client-csr.pem

openssl x509 -days 7000 -req -CA c:/myca/ca-cert.pem -CAkey c:/myca/ca-key.pem -CAcreateserial -in c:/myca/client-csr.pem -out c:/myca/client-cert.pem

openssl pkcs12 -export -in c:/myca/client-cert.pem -inkey c:/myca/client-key.pem -certfile c:/myca/ca-cert.pem -out c:/myca/client.pfx

HTTPS 服务器代码

var https = require('https');
var fs = require('fs');
var express = require("express");
var app = express();

var options = {
//key: fs.readFileSync('c:/myca/server-key.pem'),
//cert: fs.readFileSync('c:/myca/server-cert.pem'),
//ca: [fs.readFileSync('c:/myca/ca-cert.pem')],
pfx:fs.readFileSync('c:/myca/server.pfx'),
passphrase:'test'
};

function defaultRes(req,res){
res.writeHead(200);
res.end('hello world\n');
}
https.createServer(options,app).listen(3000,'127.0.0.1');

// routes
app.get('/', function(req, res) {
console.log("path:",req.route.path);
res.send('hello world\n');
});
app.get('/test', function(req, res) {
console.log("path:",req.route.path);
res.send('test');
});

HTTPS 客户端代码

var https = require('https');
var fs = require('fs');

var options = {
hostname:'127.0.0.1',
port:3000,
path:'/',
method:'GET',
pfx:fs.readFileSync('c:/myca/client.pfx'),
passphrase:'test',//your ca password
agent:false
};

options.agent = new https.Agent(options);
var req = https.request(options,function(res){
console.log("statusCode: ", res.statusCode);
console.log("headers: ", res.headers);
res.setEncoding('utf-8');
res.on('data',function(d){
console.log(d);
})
});

免费证书