Compare commits
	
		
			1 Commits
		
	
	
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
| 28adbff624 | 
							
								
								
									
										4
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										4
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							@ -25,7 +25,3 @@ build/Release
 | 
				
			|||||||
# Deployed apps should consider commenting this line out:
 | 
					# Deployed apps should consider commenting this line out:
 | 
				
			||||||
# see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git
 | 
					# see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git
 | 
				
			||||||
node_modules
 | 
					node_modules
 | 
				
			||||||
 | 
					 | 
				
			||||||
# IntelliJ
 | 
					 | 
				
			||||||
.idea
 | 
					 | 
				
			||||||
*.iml
 | 
					 | 
				
			||||||
 | 
				
			|||||||
							
								
								
									
										69
									
								
								README.md
									
									
									
									
									
								
							
							
						
						
									
										69
									
								
								README.md
									
									
									
									
									
								
							@ -125,74 +125,6 @@ So instead of trying to work through eleventeen brazillion errors
 | 
				
			|||||||
about self-signed certs, you can just create an authority and then
 | 
					about self-signed certs, you can just create an authority and then
 | 
				
			||||||
add the authority to your chain (viola, now it's trusted).
 | 
					add the authority to your chain (viola, now it's trusted).
 | 
				
			||||||
 | 
					
 | 
				
			||||||
Client Authentication
 | 
					 | 
				
			||||||
====
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
In the example above, the server trusts the client without the need for the client to be authenticated.
 | 
					 | 
				
			||||||
So, a common enhancement to the example above would be to add client authentication.
 | 
					 | 
				
			||||||
To add client authentication, it's necessary to generate a client key and have it signed by the CA defined above.
 | 
					 | 
				
			||||||
Execute `make-client-key-certificate.sh` to generate key and certificate.
 | 
					 | 
				
			||||||
To use generated key and certificate, `key`, `cert` and `passphrase` TLS options need to be added, e.g.:
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
```
 | 
					 | 
				
			||||||
var ca = fs.readFileSync(path.join(__dirname, 'certs', 'client', 'chain.pem'));
 | 
					 | 
				
			||||||
var key = fs.readFileSync(path.join(__dirname, 'certs', 'client-auth', 'privkey.pem'));
 | 
					 | 
				
			||||||
var passphrase = 'secret';
 | 
					 | 
				
			||||||
var cert = fs.readFileSync(path.join(__dirname, 'certs', 'client-auth', 'cert.pem'));
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
var options = {
 | 
					 | 
				
			||||||
  host: hostname
 | 
					 | 
				
			||||||
, port: port
 | 
					 | 
				
			||||||
, path: '/'
 | 
					 | 
				
			||||||
, ca: ca
 | 
					 | 
				
			||||||
, key: key
 | 
					 | 
				
			||||||
, passphrase: passphrase
 | 
					 | 
				
			||||||
, cert: cert
 | 
					 | 
				
			||||||
};
 | 
					 | 
				
			||||||
```
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
Generating Java Key Stores
 | 
					 | 
				
			||||||
====
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
If the server component is written in Java, the server needs to be plugged with a Java KeyStore containing security certificates.
 | 
					 | 
				
			||||||
In the example above, the `fullchain.pem` file needs to be converted into a Java KeyStore file.
 | 
					 | 
				
			||||||
To create a Java KeyStore file, the JDK needs to be installed and have `keytool` utility in the path.
 | 
					 | 
				
			||||||
To do that, please follow these instructions:
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
    $ mkdir certs/java/server
 | 
					 | 
				
			||||||
    $ openssl pkcs12 \
 | 
					 | 
				
			||||||
      -export \
 | 
					 | 
				
			||||||
      -inkey certs/server/privkey.pem \
 | 
					 | 
				
			||||||
      -in certs/server/fullchain.pem \
 | 
					 | 
				
			||||||
      -name test \
 | 
					 | 
				
			||||||
      -out certs/java/server/keystore_server.p12
 | 
					 | 
				
			||||||
    $ keytool \
 | 
					 | 
				
			||||||
      -importkeystore \
 | 
					 | 
				
			||||||
      -srckeystore certs/java/server/keystore_server.p12 \
 | 
					 | 
				
			||||||
      -srcstoretype pkcs12 \
 | 
					 | 
				
			||||||
      -destkeystore certs/java/server/keystore_server.jks
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
Trust Store for Client Authentication
 | 
					 | 
				
			||||||
----
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
If using client authentication, it is necessary for the server to trust to the client.
 | 
					 | 
				
			||||||
To do that, it's necessary for a trust store to be created that contains the client's public key.
 | 
					 | 
				
			||||||
Such a trust store can be created using these steps:
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
    $ rsync -a certs/ca/my-root-ca.crt.pem certs/client-auth/chain.pem
 | 
					 | 
				
			||||||
    $ cat certs/client-auth/cert.pem certs/client-auth/chain.pem > certs/client-auth/fullchain.pem
 | 
					 | 
				
			||||||
    $ openssl pkcs12
 | 
					 | 
				
			||||||
      \-export
 | 
					 | 
				
			||||||
      \-inkey certs/client-auth/privkey.pem
 | 
					 | 
				
			||||||
      \-in certs/client-auth/fullchain.pem
 | 
					 | 
				
			||||||
      \-name test
 | 
					 | 
				
			||||||
      \-out certs/infinispan/trustore_server.p12
 | 
					 | 
				
			||||||
    $ keytool
 | 
					 | 
				
			||||||
      \-importkeystore
 | 
					 | 
				
			||||||
      \-srckeystore certs/infinispan/trustore_server.p12
 | 
					 | 
				
			||||||
      \-srcstoretype pkcs12
 | 
					 | 
				
			||||||
      \-destkeystore certs/infinispan/trustore_server.jks
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
Other SSL Resources
 | 
					Other SSL Resources
 | 
				
			||||||
=========
 | 
					=========
 | 
				
			||||||
 | 
					
 | 
				
			||||||
@ -202,7 +134,6 @@ Zero-Config clone 'n' run (tm) Repos:
 | 
				
			|||||||
* [node.js HTTPS SSL Example](https://github.com/coolaj86/nodejs-ssl-example)
 | 
					* [node.js HTTPS SSL Example](https://github.com/coolaj86/nodejs-ssl-example)
 | 
				
			||||||
* [node.js HTTPS SSL Self-Signed Certificate Example](https://git.coolaj86.com/coolaj86/nodejs-self-signed-certificate-example)
 | 
					* [node.js HTTPS SSL Self-Signed Certificate Example](https://git.coolaj86.com/coolaj86/nodejs-self-signed-certificate-example)
 | 
				
			||||||
* [node.js HTTPS SSL Trusted Peer Client Certificate Example](https://github.com/coolaj86/nodejs-ssl-trusted-peer-example)
 | 
					* [node.js HTTPS SSL Trusted Peer Client Certificate Example](https://github.com/coolaj86/nodejs-ssl-trusted-peer-example)
 | 
				
			||||||
* [node.js HTTPS SSL module for Loopback](https://www.npmjs.com/package/loopback-ssl)
 | 
					 | 
				
			||||||
* [SSL Root CAs](https://github.com/coolaj86/node-ssl-root-cas)
 | 
					* [SSL Root CAs](https://github.com/coolaj86/node-ssl-root-cas)
 | 
				
			||||||
 | 
					
 | 
				
			||||||
Articles
 | 
					Articles
 | 
				
			||||||
 | 
				
			|||||||
@ -1,38 +0,0 @@
 | 
				
			|||||||
#!/bin/bash
 | 
					 | 
				
			||||||
FQDN=$1
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# make directories to work from
 | 
					 | 
				
			||||||
mkdir -p certs/{client-auth}
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# Generate a client private key
 | 
					 | 
				
			||||||
openssl genrsa \
 | 
					 | 
				
			||||||
  -passout pass:secret \
 | 
					 | 
				
			||||||
  -out certs/client-auth/privkey.pem \
 | 
					 | 
				
			||||||
  2048
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# Create a request from your Device, which your Root CA will sign
 | 
					 | 
				
			||||||
openssl req -new \
 | 
					 | 
				
			||||||
  -key certs/client-auth/privkey.pem \
 | 
					 | 
				
			||||||
  -out certs/tmp/client-csr.pem \
 | 
					 | 
				
			||||||
  -subj "/C=US/ST=Utah/L=Provo/O=ACME Tech Inc/CN=${FQDN}"
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# Sign the request from Device with your Root CA
 | 
					 | 
				
			||||||
openssl x509 \
 | 
					 | 
				
			||||||
  -req -in certs/tmp/client-csr.pem \
 | 
					 | 
				
			||||||
  -CA certs/ca/my-root-ca.crt.pem \
 | 
					 | 
				
			||||||
  -CAkey certs/ca/my-root-ca.key.pem \
 | 
					 | 
				
			||||||
  -CAcreateserial \
 | 
					 | 
				
			||||||
  -out certs/client-auth/cert.pem \
 | 
					 | 
				
			||||||
  -days 500
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# Create a public key, for funzies
 | 
					 | 
				
			||||||
# see https://gist.github.com/coolaj86/f6f36efce2821dfb046d
 | 
					 | 
				
			||||||
openssl rsa \
 | 
					 | 
				
			||||||
  -in certs/server/privkey.pem \
 | 
					 | 
				
			||||||
  -pubout -out certs/client/pubkey.pem
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
# Put things in their proper place
 | 
					 | 
				
			||||||
rsync -a certs/ca/my-root-ca.crt.pem certs/server/chain.pem
 | 
					 | 
				
			||||||
rsync -a certs/ca/my-root-ca.crt.pem certs/client/chain.pem
 | 
					 | 
				
			||||||
cat certs/server/cert.pem certs/server/chain.pem > certs/server/fullchain.pem
 | 
					 | 
				
			||||||
@ -1,6 +1,6 @@
 | 
				
			|||||||
{
 | 
					{
 | 
				
			||||||
  "name": "nodejs-self-signed-certificate-example",
 | 
					  "name": "nodejs-self-signed-certificate-example",
 | 
				
			||||||
  "version": "1.1.2",
 | 
					  "version": "1.1.1",
 | 
				
			||||||
  "description": "The end off all your self-sign certificate woes (in node.js at least)",
 | 
					  "description": "The end off all your self-sign certificate woes (in node.js at least)",
 | 
				
			||||||
  "main": "serve.js",
 | 
					  "main": "serve.js",
 | 
				
			||||||
  "scripts": {
 | 
					  "scripts": {
 | 
				
			||||||
 | 
				
			|||||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user