Question

我正在尝试使节点https使用自签名证书，并且请求到达IP地址而不是DNS名称。我正在使用此代码

var tls = require('tls');
var fs = require('fs');

var cert = fs.readFileSync(__dirname + '/cert.pem');
var key = fs.readFileSync(__dirname + '/key.pem');

var netServer = new tls.Server(options = { key: key, cert: cert });
var port = 54321;

netServer.listen(port);

netServer.on('secureConnection', function(socket) {
    socket.end('heyyyoooo');
});

var client = tls.connect(port, 'localhost', {
    ca: [ cert ],
    rejectUnauthorized: true
});

client.on('data', function(data) {
    console.log(data.toString());
    process.exit();
});

当localhost发出请求时，它与these instructions生成的证书（没有主题备用名称）一起工作正常，但是当我用127.0.0.1替换它时，我得到{{ 1}}。所以我创建了一个使用Error: Hostname/IP doesn't match certificate's altnames生成的新证书。 Openssl将其读作：

subjectAltName

因此SAN正确创建。现在我得到了Certificate: Data: Version: 3 (0x2) Serial Number: 11107838472034892631 (0x9a26f83d0c0ebb57) Signature Algorithm: sha1WithRSAEncryption Issuer: CN=127.0.0.1 Validity Not Before: Jun 24 09:51:56 2013 GMT Not After : Jun 22 09:51:56 2023 GMT Subject: CN=127.0.0.1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: *skipped* Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Key Encipherment, Data Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Subject Alternative Name: DNS:localhost, IP Address:127.0.0.1 Signature Algorithm: sha1WithRSAEncryption *skipped*，我该如何让它发挥作用？

Answer 1

试试这个：

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';

nodejs - 带有自签名证书的UNABLE_TO_VERIFY_LEAF_SIGNATURE

1 个答案: