coolaj86
/
nodejs-self-signed-certificate-example
1
0
Fork 0
Code Issues 1 Pull Requests Releases Wiki Activity
The end off all your self-sign certificate woes (in node.js at least)
22 Commits 1 Branch 3 Tags 46 KiB
Shell 65.5%
JavaScript 34.5%
Go to file
AJ ONeal 13d73b89c0 Merge branch 'master' of github.com:coolaj86/nodejs-self-signed-certificate-example 2016-06-27 18:22:29 -06:00
.gitignore move keys and certs to ./certs and update paths 2014-07-15 22:54:02 -06:00
LICENSE Initial commit 2014-07-14 20:50:17 -06:00
README.md Merge branch 'master' of github.com:coolaj86/nodejs-self-signed-certificate-example 2016-06-27 18:22:29 -06:00
make-root-ca-and-certificates.sh add fullchain.pem 2016-06-27 18:08:25 -06:00
package.json http -> https 2016-06-27 18:04:12 -06:00
request-without-warnings.js use letsencrypt naming convention, and more recent localhost.daplie.com 2016-06-27 18:01:05 -06:00
serve.js use letsencrypt naming convention, and more recent localhost.daplie.com 2016-06-27 18:22:23 -06:00
test.sh use letsencrypt naming convention, and more recent localhost.daplie.com 2016-06-27 18:03:32 -06:00

README.md

nodejs-self-signed-certificate-example

The end off all your self-signed certificate woes (in node.js at least)

This is an easy-as-git-clone example that will get you on your way without any DEPTH_ZERO_SELF_SIGNED_CERT or SSL certificate problem: Invalid certificate chain headaches.

See the explanation for the many details.

Also, you may be interested in coolaj86/nodejs-ssl-trusted-peer-example.

Test for yourself

An example that works.

example
├── make-root-ca-and-certificates.sh
├── package.json
├── serve.js
└── request-without-warnings.js

Get the repo

git clone git@github.com:coolaj86/nodejs-self-signed-certificate-example.git
pushd nodejs-self-signed-certificate-example
npm install

For the super impatient:

bash test.sh

Create certificates for your FQDN

localhost.daplie.com points to localhost, so it's ideal for your first test.

bash make-root-ca-and-certificates.sh 'localhost.daplie.com'

certs/
├── ca
│   ├── my-root-ca.crt.pem
│   ├── my-root-ca.key.pem
│   └── my-root-ca.srl
├── client
│   ├── chain.pem
│   └── pubkey.pem
├── server
│   ├── cert.pem
│   ├── chain.pem
│   ├── fullchain.pem
│   └── privkey.pem
└── tmp
    └── csr.pem

Run the server

node ./serve.js 8043 &
# use `fg` and `ctrl+c` to kill

Test in a client

Test (warning free) in node.js

node ./request-without-warnings.js 8043

Test (warning free) with cURL

curl -v https://localhost.daplie.com:8043 \
  --cacert certs/client/chain.pem

Note: on macOS curl's --cacert option may not work properly and so you may need to add the cert to the system keychain (described below)

Visit in a web browser

https://localhost.daplie.com:8043

To get rid of the warnings, simply add the certificate in the client folder to your list of certificates by alt-clicking "Open With => Keychain Access" on chain.pem

You do have to set Always Trust a few times as explained by Rob Peck.

Now season to taste

You can poke around in the files for generating the certificates, but all you really have to do is replace localhost.daplie.com with your very own domain name.

But where's the magic?

Who's the man behind the curtain you ask?

Well... I lied. This demo doesn't use self-signed certificates (not in the server at least). It uses a self-signed Root CA and a signed certificate.

It turns out that self-signed certificates were designed to be used by the Root Certificate Authorities, not by web servers.

So instead of trying to work through eleventeen brazillion errors about self-signed certs, you can just create an authority and then add the authority to your chain (viola, now it's trusted).

Other SSL Resources

Zero-Config clone 'n' run (tm) Repos:

Articles