创造＆amp;使用自签名证书运行安全（https）nodejs express应用程序 - 分段错误

Question

按照本指南https://git.coolaj86.com/coolaj86/ssl-root-cas.js/src/branch/master/Painless-Self-Signed-Certificates-in-node.js.md，我已使用以下脚本创建了根CA和签名证书：

make-certs.sh

#!/bin/bash
FQDN=`hostname`

# make directories to work from
rm -rf certs
mkdir -p certs/{server,client,ca,tmp}

# Create your very own Root Certificate Authority
openssl genrsa \
  -out certs/ca/my-root-ca.key.pem \
  2048

# Self-sign your Root Certificate Authority
# Since this is private, the details can be as bogus as you like
openssl req \
  -x509 \
  -new \
  -nodes \
  -key certs/ca/my-root-ca.key.pem \
  -days 1024 \
  -out certs/ca/my-root-ca.crt.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=${FQDN}/CN=${FQDN}"

# Create a Device Certificate for each domain,
# such as example.com, *.example.com, awesome.example.com
# NOTE: You MUST match CN to the domain name or ip address you want to use
openssl genrsa \
  -out certs/server/privkey.pem \
  2048

# Create a request from your Device, which your Root CA will sign
openssl req -new \
  -key certs/server/privkey.pem \
  -out certs/tmp/csr.pem \
  -subj "/C=US/ST=Utah/L=Provo/O=${FQDN}/CN=${FQDN}"

# Sign the request from Device with your Root CA
# -CAserial certs/ca/my-root-ca.srl
openssl x509 \
  -req -in certs/tmp/csr.pem \
  -CA certs/ca/my-root-ca.crt.pem \
  -CAkey certs/ca/my-root-ca.key.pem \
  -CAcreateserial \
  -out certs/server/cert.pem \
  -days 500

# Create a public key, for funzies
# see https://gist.github.com/coolaj86/f6f36efce2821dfb046d
openssl rsa \
  -in certs/server/privkey.pem \
  -pubout -out certs/client/pubkey.pem

# Put things in their proper place
rsync -a certs/ca/my-root-ca.crt.pem certs/server/chain.pem
rsync -a certs/ca/my-root-ca.crt.pem certs/client/chain.pem
cat certs/server/cert.pem certs/server/chain.pem > certs/server/fullchain.pem

然后我使用以下内容设置 package.json ：

{
  "name": "api-server",
  "version": "1.0.0",
  "description": "API Server",
  "main": "api-server.js",
  "dependencies": {
    "body-parser": "^1.15.2",
    "express": "^4.14.0"
  }
}

执行 npm install ，然后创建我的 api-server.js ，如下所示：

// Load libraries
var https      = require('https'),
    fs         = require('fs'), 
    express    = require('express'), 
    app        = express(),
    bodyParser = require('body-parser');

// Server setting
var port = process.env.PORT || 8080;

// Register body-parser
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));

// Configure router
var router = express.Router();
app.use('/api/v1', router);

// Register routes
router.get('/', function(req, res) {
    res.json({ success: true });
});

// Create & run https api server
var secureServer = https.createServer({
    key: fs.readFileSync('./certs/server/privkey.pem'),
    cert: fs.readFileSync('./certs/server/fullchain.pem'),
    requestCert: true,
    rejectUnauthorized: false
}, app).listen(port, function() {
    console.log('API Server Started On Port %d', port);
});

最后，我使用节点api-server.js 启动了应用，并在chrome中访问了https://<my-ip>:8080/。

我收到以下错误：

This site can’t be reached
192.168.0.21 refused to connect.

查看服务器的控制台日志，我看到以下内容：

我在这里做错了什么想法？

Answer 1

我找到了解决这个问题的方法。

<强> make-certs.sh

#!/bin/bash

FQDN=`hostname`
rm server.key server.crt
openssl genrsa -out server.key 2048
openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj "/C=GB/ST=Street/L=City/O=Organisation/OU=Authority/CN=${FQDN}"
openssl x509 -req -days 1024 -in server.csr -signkey server.key -out server.crt
rm server.csr

<强> API-server.js

// Import libraries
var express = require('express');
var server = express();
var bodyParser = require('body-parser')
var https = require('https');
var fs = require('fs');

// Server setting
var port = process.env.PORT || 8080;

// Register body-parser
server.use(bodyParser.json());
server.use(bodyParser.urlencoded({ extended: true }));

// Configure router
var router = express.Router();
server.use('/api/v1', router);

// Create https server & run
https.createServer({
    key: fs.readFileSync('server.key'),
    cert: fs.readFileSync('server.crt')
}, server).listen(port, function() {
    console.log('API Server Started On Port %d', port);
});

// Register routes
router.get('/', function(req, res) {
    res.json({ success: true });
});

这现在有效。