Question

我尝试设置express应用以使用https。这是我到目前为止所得到的：

var fs = require('fs');
var http = require('http');
var https = require('https');
var app = require('./app');
var port = process.env.PORT || 8080;

var credentials = {
    key: fs.readFileSync('./ssl/private_key.pem', 'utf8'),
    cert: fs.readFileSync('./ssl/certificate.pem', 'utf8'),
    ca: [
        fs.readFileSync('./ssl/certificate_chain_1.pem', 'utf8'),
        fs.readFileSync('./ssl/certificate_chain_2.pem', 'utf8')
    ]
};
https.createServer(credentials, app, function (req, res) {
    res.writeHead(200);
    res.end('HTTPS server started on port ' + port + '...');
}).listen(port);

当我跑步时，curl -k -v -I https://127.0.0.1:8080，我明白了：

* Rebuilt URL to: https://127.0.0.1:8080/
* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
* TLS 1.2 connection using TLS_RSA_WITH_AES_256_CBC_SHA256
* Server certificate: *.hiwarren.com
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> HEAD / HTTP/1.1
> User-Agent: curl/7.37.1
> Host: 127.0.0.1:8080
> Accept: */*
>
< HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
< X-Powered-By: Express
X-Powered-By: Express
< X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Content-Length: 14
Content-Length: 14
< Date: Wed, 15 Apr 2015 19:32:28 GMT
Date: Wed, 15 Apr 2015 19:32:28 GMT
< Connection: keep-alive
Connection: keep-alive

<
* Connection #0 to host 127.0.0.1 left intact

当我运行OpenSSL s_client -connect 127.0.0.1:8080/

时

我收到此错误：

MacBook-Pro-de-Bruno-3:ssl brunomacedo$ OpenSSL s_client -connect 127.0.0.1:8080/
CONNECTED(00000003)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.hiwarren.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
Server certificate
-----BEGIN CERTIFICATE-----
... certificate hash ...
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.hiwarren.com
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 4627 bytes and written 626 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-GCM-SHA384
    Session-ID: 957E02E1D64D1F1E0ADBF4369057DD56B5FBE5A66269686DD590DF4D3B9A3D8C
    Session-ID-ctx:
    Master-Key: 0B531BBFE5AA8AACEFC99749CD696926956419FFD61F7CCAF6E94C7574F6ECCEA31098D236E51F800F690D508E700444
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 25 2c fa ce af 2d f9 6e-8e fd 7e 9c f4 e6 c8 2b   %,...-.n..~....+
    0010 - 10 b6 f9 08 28 23 6f ec-98 0d c9 1d dd 78 34 25   ....(#o......x4%
    0020 - ab 21 55 37 02 42 a8 6c-84 9f 31 c0 60 ed 77 ae   .!U7.B.l..1.`.w.
    0030 - ab ea 4f 84 07 e7 d0 29-24 41 35 0f d7 01 09 21   ..O....)$A5....!
    0040 - a2 0f 1c 10 ab e4 47 67-f0 0d b0 f2 32 8d 3e f0   ......Gg....2.>.
    0050 - 10 30 35 82 48 df 09 ac-7c 12 98 11 99 7f 97 5b   .05.H...|......[
    0060 - d2 ef 47 69 4c 86 8b 2f-48 ff 62 58 08 7b 6c 7b   ..GiL../H.bX.{l{
    0070 - c2 f5 c5 1d 52 13 ad c4-95 d8 54 f8 a5 d2 5c 94   ....R.....T...\.
    0080 - c0 f3 c1 40 c1 44 5e b0-37 fa 3b 68 73 a7 ca 4f   ...@.D^.7.;hs..O
    0090 - ac d9 99 12 62 72 10 48-f1 9a 56 eb e6 89 d8 d4   ....br.H..V.....

    Start Time: 1429126474
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

当我使用error 20运行相同的命令时，我能够解决root_certificate：OpenSSL s_client -connect 127.0.0.1:8080/ -CAfile certificate_root.pem。

所以，这是我的新输出：

MacBook-Pro-de-Bruno-3:ssl brunomacedo$ OpenSSL s_client -connect 127.0.0.1:8080/ -CAfile certificate_root.pem
CONNECTED(00000003)
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
verify return:1
depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.hiwarren.com
verify return:1
---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.hiwarren.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
Server certificate
-----BEGIN CERTIFICATE-----
... certificate hash ...
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.hiwarren.com
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 4627 bytes and written 626 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-GCM-SHA384
    Session-ID: CFD47EDA05B183790D25B32295550DB4DF74C483F3B1FEACD76C39548254FD9C
    Session-ID-ctx:
    Master-Key: DE16062EE238F854A4578F2E0F8FBE6874AF8550086E61C1D50EF3FBDB04F42355A6BD2072B8216B68477516E7F034C5
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 25 2c fa ce af 2d f9 6e-8e fd 7e 9c f4 e6 c8 2b   %,...-.n..~....+
    0010 - 16 26 97 0b a6 00 c6 12-d3 9a 91 1c d1 0f a4 d7   .&..............
    0020 - 96 30 88 54 3c e7 42 a1-db 4c 97 e6 68 5c d4 81   .0.T<.B..L..h\..
    0030 - f5 bf 7f 16 59 d2 32 bd-fa c7 9b c4 b5 1f a2 4d   ....Y.2........M
    0040 - 3b fe f9 af ad 29 58 31-c5 2e 2b 31 b1 52 62 9c   ;....)X1..+1.Rb.
    0050 - 1a 34 d0 c5 e4 e7 80 1f-d4 8a a3 0f 6b f4 2b d9   .4..........k.+.
    0060 - 4e 5d c0 8c 11 5a 0d de-00 23 19 0f 01 73 92 32   N]...Z...#...s.2
    0070 - 50 ee 08 56 4b a0 1c 20-c6 d7 9d de 58 b0 d4 70   P..VK.. ....X..p
    0080 - 2f b6 ca 3b 48 d0 bb fe-4c ea 6e 60 31 5d 4f 3d   /..;H...L.n`1]O=
    0090 - a4 6e f8 cd a2 15 1a 0e-36 6d b7 16 72 b9 e4 bf   .n......6m..r...

    Start Time: 1429126610
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

所以，我认为客户端需要以某种方式发送此root_certificate以使其正常工作，但我不确定客户端如何拥有它并发送它。

任何人都经历过这个？我该怎么办？

Answer 1

curl -k -v -I https://127.0.0.1:8080
...
openssl s_client -connect 127.0.0.1:8080
...
0 s:/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.hiwarren.com
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
....

CA不再是IP地址的颁发者证书。他们多年来没有颁发RFC 1918 addresses证书（如127.0.0.1）。

您需要修复证书或修复名称解析。首先，通过在证书的localhost（127.0.0.1）中加入subjectAlternateName和SAN等名称进行修复。

或者第二，通过使证书中使用的名称访问该服务器来修复它。您可以通过使用本地hosts文件或DNS进行技巧来实现这一目标。

unable to get local issuer certificate

请务必设置根证书。根证书是AddTrust External CA Root。

确保使用服务器证书发送链。这里，链是所有中间证书 less 根。您必须已拥有根证书并信任它。

Answer 2

我不确定具体问题是什么;

当我使用root_certificate运行相同的命令时，我能够解决错误20：OpenSSL s_client -connect 127.0.0.1:8080/-CAfile certificate_root.pem。

所以，我认为客户端需要以某种方式发送这个root_certificate，以使其工作，但我不确定客户端如何拥有它并发送它。

提供根证书时错误20消失了。这是因为客户端可以使用提供的CAfile成功验证（验证代码0（OK））服务器证书。

当您没有提供根证书时，客户端不知道服务器是谁。无法验证服务器的凭据。因此错误20。

客户端不将根证书发送到服务器。怎么有它？您应该知道并拥有公开可用的可信CA证书。（例如，您的浏览器预先加载了一组众所周知的CA证书。因此您可以通过HTTPS连接到任何知名网站）

在Express中设置HTTPS服务器时遇到问题

2 个答案: