使用godaddy gd_bundle.crt运行SSL node.js服务器

Question

我无法让我的SSL服务器使用来自godaddy的证书

使用Express:3.1.0

下面是一个在本地生成/没有由go daddy签名的密钥/ crt(浏览器抱怨,但如果你添加异常,它可以工作.

var http = require('https');    
var privateKey  = fs.readFileSync('/var/www/dev/ssl/server.key').toString();
    var certificate = fs.readFileSync('/var/www/dev/ssl/server.crt').toString();
    var credentials = {key: privateKey, cert: certificate};
    var https = http.createServer(credentials, app);

有了godaddy我提供了一个额外的文件gd_bundle.crt我相信你这样实现,但是我收到一个错误

var http = require('https');
    var privateKey  = fs.readFileSync('/var/www/prod/ssl/mysite.key').toString();
    var certificate = fs.readFileSync('/var/www/prod/ssl/mysite.com.crt').toString();
    var ca = fs.readFileSync('/var/www/prod/ssl/gd_bundle.crt').toString();
    var credentials = {key: privateKey, cert: certificate, ca: ca};
    var https = http.createServer(credentials, app);

使用此配置,我得到:错误107(net :: ERR_SSL_PROTOCOL_ERROR):SSL协议错误.

真相被告知我没有创建他们的密钥/证书我们的devops家伙...我不知道如果我正在实施godaddy那些错误或如果有一种方法来确保他正确设置密钥/ crt文件我可以解决....

有谁看到明显错误的任何明显错误？

Answer 1

Node要求CA链中的每个证书都在数组中单独传递. gd_bundle.crt可能看起来像这样:

-----BEGIN CERTIFICATE-----
MIIE3jCCA...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEADCCA...
-----END CERTIFICATE-----

每个证书都需要放在自己的文件中(即gd1.crt和gd2.crt)并单独阅读.

https.createServer({
    key: fs.readFileSync('mysite.key'),
    certificate: fs.readFileSync('mysite.crt'),
    ca: [fs.readFileSync('gd1.crt'), fs.readFileSync('gd2.crt')]
});

Answer 2

向GoDaddy询问您在SHA-1签名中的 ssl证书,并将捆绑文件分成两个文件,这样......

从你的 gd_bundle.crt

-----BEGIN CERTIFICATE-----
MIIE3jCCA8agAwIBAgICAwEwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVMx
RE4+uXR21aITVSzGh6O1mawGhId/dQb8vxRMDsxuxN89txJx9OjxUUAiKEngHUuH
qDTMBqLdElrRhjZkAzVvb3du6/KFUJheqwNTrZEjYx8WnM25sgVjOuH0aBsXBTWV
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mERdEr/VxqHD3VILs9RaRegAhJhldX
RQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5CufReYNnyicsbkqWletNw+vHX/bvZ8
-----END CERTIFICATE-----

至 gd_bundle_01.crt

-----BEGIN CERTIFICATE-----
MIIE3jCCA8agAwIBAgICAwEwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVMx
RE4+uXR21aITVSzGh6O1mawGhId/dQb8vxRMDsxuxN89txJx9OjxUUAiKEngHUuH
qDTMBqLdElrRhjZkAzVvb3du6/KFUJheqwNTrZEjYx8WnM25sgVjOuH0aBsXBTWV
-----END CERTIFICATE-----

和 gd_bundle_02.crt

-----BEGIN CERTIFICATE-----
56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mERdEr/VxqHD3VILs9RaRegAhJhldX
RQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5CufReYNnyicsbkqWletNw+vHX/bvZ8
-----END CERTIFICATE-----

然后在你的服务器上做这个

var fs = require('fs'),
    https = require('https');

var ssl = {
    key: fs.readFileSync('./ssl/server.key', 'utf8'),
    cert: fs.readFileSync('./ssl/server.crt', 'utf8'),
    ca: [fs.readFileSync('./ssl/bundle_01.crt', 'utf8'),
         fs.readFileSync('./ssl/bundle_02.crt', 'utf8')]
};

https.createServer(ssl, function(req, res) {
    //... your code here ...
}).listen(443);