nodejs – 具有自签名证书的UNABLE_TO_VERIFY_LEAF_SIGNATURE
我试图使节点https与自签名证书与请求来到IP地址而不是DNS名称的工作。 我正在使用这个代码
var tls = require('tls'); var fs = require('fs'); var cert = fs.readFileSync(__dirname + '/cert.pem'); var key = fs.readFileSync(__dirname + '/key.pem'); var netServer = new tls.Server(options = { key: key, cert: cert }); var port = 54321; netServer.listen(port); netServer.on('secureConnection', function(socket) { socket.end('heyyyoooo'); }); var client = tls.connect(port, 'localhost', { ca: [ cert ], rejectUnauthorized: true }); client.on('data', function(data) { console.log(data.toString()); process.exit(); });
当请求被发布到localhost ，它可以正常使用由这些指令生成的证书（不带主题备用名称），但是当我将其replace为127.0.0.1 ，我得到Error: Hostname/IP doesn't match certificate's altnames 。 所以我创build了一个使用subjectAltName生成的新证书。 Openssl将其读为：
Certificate: Data: Version: 3 (0x2) Serial Number: 11107838472034892631 (0x9a26f83d0c0ebb57) Signature Algorithm: sha1WithRSAEncryption Issuer: CN=127.0.0.1 Validity Not Before: Jun 24 09:51:56 2013 GMT Not After : Jun 22 09:51:56 2023 GMT Subject: CN=127.0.0.1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: *skipped* Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Key Encipherment, Data Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Subject Alternative Name: DNS:localhost, IP Address:127.0.0.1 Signature Algorithm: sha1WithRSAEncryption *skipped*
所以SAN被正确地创build了。 现在我收到Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE ，我该如何使它工作？
尝试这个：
process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';