使用openSSL構造一個支援https的nodejs伺服器
首先通過下面的連結下載openSSL
https://slproweb.com/products...
下載完畢後,執行openssl進入互動式介面:
使用命令生成privatekey.pem 1024意思是1024位長度。
openssl genrsa -out privatekey.pem 1024
生成的privatekey.pem,開啟看一看長啥樣:
什麼是pem檔案?
.pem - Defined in RFCs 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. Confusingly, it may also encode a CSR (e.g. as used here) as the PKCS10 format can be translated into PEM. The name is from Privacy Enhanced Mail (PEM), a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.
簡單的說,就是一個金鑰檔案。
第二步,基於第一步生成的金鑰檔案生成一個證書請求:
openssl req -new -key privatekey.pem -out certrequest.csr
如果懶得維護證書明細,直接敲回車,會自動填入預設值:
最後基於第一步生成的金鑰和證書請求生成一個數字證書:當然頒發機構就是自己了,僅用於測試目的。
openssl x509 -req -in certrequest.csr -signkey privatekey.pem -out certificate.pem
至此我們有了privatekey.pem和Certificate.pem兩個證書了。
下面是我https伺服器的程式碼,很簡單,只有50幾行:
var app = require('express')(); var fs= require('fs'); var https = require('https'); var httpOptions ={ key: fs.readFileSync("keys/privatekey.pem"), cert: fs.readFileSync("keys/certificate.pem") } var server = https.createServer(httpOptions, app); var io = require('socket.io')(server); console.log("https server listens on port 8080..."); server.listen(8080); function print_env(){ console.log(process.env); } app.get('/', function (req, res) { var response = "Hello World"; res.send(response); }); app.get('/env', function (req, res) { print_env(); // res.sendFile(__dirname + '/index.html'); var response = JSON.stringify(process.env); res.send(response); }); app.get('/redis', function (req, res) { var redisClient = require("./redisClient"); function callback(response){ // var response = "ok";//JSON.stringify(process.env); res.send(response); } redisClient.test(callback); }); io.on('connection', function (socket) { console.log("connect comming from client: " + socket.id); socket.emit('messages_jerry', { hello: 'world greeting from Server!' }); socket.on('messages', function (data) { console.log("data received from Client:" + JSON.stringify(data,2,2)); }); });
從程式碼裡不難理解這兩個pem檔案是如何用在https伺服器裡的。
最後在瀏覽器裡測試。因為是自己頒發的證書,沒有經過CA驗證,所以瀏覽器會顯示一個警告。
要獲取更多Jerry的原創文章,請關注公眾號"汪子熙":