Node.js - 使用带有内部 CA 的 https.request()

Question

我应该让 https.request() 信任我的内部签名服务器证书。这是我在 v0.10.25 中运行的代码的简单示例:

var options = {
     hostname: 'encrypted.mydomain.local',
     port: 443,
     path: '/',
     method: 'GET'
};

var https = require('https')
https.request(options)

我在 Windows 系统上运行它，该系统在系统级别信任我的内部根 CA，但每当我发出这样的请求时，我都会收到异常

events.js:72
        throw er; // Unhandled 'error' event
              ^
Error: CERT_UNTRUSTED
    at SecurePair.<anonymous> (tls.js:1370:32)
    at SecurePair.EventEmitter.emit (events.js:92:17)
    at SecurePair.maybeInitFinished (tls.js:982:10)
    at CleartextStream.read [as _read] (tls.js:469:13)
    at CleartextStream.Readable.read (_stream_readable.js:320:10)
    at EncryptedStream.write [as _write] (tls.js:366:25)
    at doWrite (_stream_writable.js:223:10)
    at writeOrBuffer (_stream_writable.js:213:5)
    at EncryptedStream.Writable.write (_stream_writable.js:180:11)
    at write (_stream_readable.js:583:24)

更详细一点，这一切都发生在 node-atlassian-crowd 内部我试图用于身份验证的模块

Answer 1

您需要在选项中添加 ca: cafile.pem 行。参见 http://nodejs.org/api/https.html#https_https_request_options_callback了解更多详情。

相关部分:

The following options from tls.connect() can also be specified. However, a globalAgent silently ignores these.

pfx: Certificate, Private key and CA certificates to use for SSL. Default null.

key: Private key to use for SSL. Default null.

passphrase: A string of passphrase for the private key or pfx. Default null.

cert: Public x509 certificate to use. Default null.

ca: An authority certificate or array of authority certificates to check the remote host against.

在应用程序启动期间，使用类似 var casigningcert = fs.readFileSync('keys/ca-certsigning-cert.pem') 的内容读取 CA 的证书文件，然后稍后在您的选项中使用它，它应该看起来像:

var options = {
  hostname: 'encrypted.mydomain.local',
  port: 443,
  path: '/',
  method: 'GET',
  ca: casigningcert
  };