ssl - 尝试创建 HTTPS 后运行 node-red-start "Error 140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small"

Question

大家好，我一直在为我的树莓派设置对 node-red 的远程访问。我已经修改了 settings.js 并安装了 node-red-admin 但是当我去启动 node-red 时我收到以下错误:

Error: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
at Object.createSecureContext (_tls_common.js:131:17)
at Server.setSecureContext (_tls_wrap.js:1152:27)
at Server (_tls_wrap.js:1030:8)
at new Server (https.js:65:14)
at Object.createServer (https.js:89:10)
at Object.<anonymous> (/usr/lib/node_modules/node-red/red.js:141:20)
at Module._compile (internal/modules/cjs/loader.js:945:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:962:10)
at Module.load (internal/modules/cjs/loader.js:798:32)
at Function.Module._load (internal/modules/cjs/loader.js:711:12) {
library: 'SSL routines',
  function: 'SSL_CTX_use_certificate',
  reason: 'ee key too small',
  code: 'ERR_SSL_EE_KEY_TOO_SMALL'
}
nodered.service: Main process exited, code=exited, status=1/FAILURE
nodered.service: Failed with result 'exit-code'.
nodered.service: Service RestartSec=100ms expired, scheduling restart.
nodered.service: Scheduled restart job, restart counter is at 1.
Stopped Node-RED graphical event wiring tool.
Started Node-RED graphical event wiring tool.
_tls_common.js:131
  c.context.setCert(cert);

这发生在我成功创建 privatekey.pem 和 certificate.pem 之后。为了创建这些文件，我使用了:

openssl genrsa -out privatekey.pem 1024

然后用

openssl req -new -key privatekey.pem -out private-csr.pem

之后我输入了相关信息，然后收到验证“signature is ok”

openssl x509 -req -days 365 -in private-csr.pem -signkey privatekey.pem -out certificate.pem

由于上面在 ls -la 下返回了 privatekey.pem 和 certificate.pem 文件，我移动到取消注释以下内容:

// The `https` setting requires the `fs` module. Uncomment the 
following
// to make it available:
var fs = require("fs");
module.exports = {
// the tcp port that the Node-RED web server is listening on
uiPort: process.env.PORT || 1880,

还有

adminAuth: {
type: "credentials",
users: [
    {
username: "admin",
password: "$2a$08$9Miva2AQEFlXQ3S7emXlIuLkLzNzi9yzgqxGYMY5dzK4FzNQa7dCu",
permissions: "*" 
    }
]
},

加载fs模块

https: {
key: fs.readFileSync('/home/pi/.node-red/privatekey.pem'),
cert: fs.readFileSync('/home/pi/.node-red/certificate.pem')
},

完成此配置后，我收到开头所述的错误消息。更新:我确实删除了 .node-red/settings.js 的内容并替换为 https://github.com/node-red/node-red/blob/master/packages/node_modules/node-red/settings.js节点红色开始了!哇哦!但是，当再次尝试重新配置 settings.js 文件时，它会遇到同样的错误。仅供引用，我正在小心地取消注释行，但是问题可能出在我从 node-red-admin 收到的哈希密码中吗？因为当我在通过“su”以 root 身份登录后尝试使用“npm install -g node-red-admin”安装 node-red-admin 时，它会出现以下内容:

pi@padrejuan:~ $ su
Password: 
root@padrejuan:/home/pi# npm install -g node-red-admin
/usr/local/bin/node-red-admin -> /usr/local/lib/node_modules/node-red- 
admin/node-red-admin.js

> bcrypt@3.0.6 install /usr/local/lib/node_modules/node-red- 
admin/node_modules/bcrypt
> node-pre-gyp install --fallback-to-build

node-pre-gyp WARN Using request for node-pre-gyp https download 
node-pre-gyp WARN Pre-built binaries not installable for bcrypt@3.0.6 
and node@12.11.1 (node-v72 ABI, glibc) (falling back to source compile 
with node-gyp) 
node-pre-gyp WARN Hit error EACCES: permission denied, mkdir 
'/usr/local/lib/node_modules/node-red-admin/node_modules/bcrypt/lib' 
gyp WARN EACCES user "nobody" does not have permission to access the 
dev dir "/root/.cache/node-gyp/12.11.1"
gyp WARN EACCES attempting to reinstall using temporary dev dir 
"/usr/local/lib/node_modules/node-red-admin/node_modules/bcrypt/.node- 
gyp"
gyp WARN install got an error, rolling back install
gyp WARN install got an error, rolling back install
gyp ERR! configure error

等等。

任何帮助将不胜感激

Answer 1

问题是最新版本的 openssl 现在认为位长为 1024 的 key 是不安全的。

重新生成大小为2048的私钥，然后重新创建证书。

openssl genrsa -out privatekey.pem 2048