0

I am having trouble making Node.js HTTPS or secure HTTP2 work on localhost. But I assume localhost is a special case, and so for this question I'm asking now, I would like to know for a production setup, what pieces of the puzzle do I need to make secure Node.js communication between a client and a server?

More specifically, I am going to have a public website / REST API at https://example.com, and a "public" HTTP2 Node.js client that uses require('http2').connect to make requests. Basically what I am looking for is what options I need when creating the HTTP2 server in Node.js, what the certificates need to be from (or would letsencrypt give me everything I need), and what options the HTTP2 client needs to contain.

Here is what I have for the server:

var server = http2.createSecureServer({
  key: private,
  cert: public,
  passphrase: password,
  ca: ?,
  allowHTTP1: true,
  secureProtocol: 'TLSv1_2_method'
}, handleServerRequest)

Setting the secureProtocol to the lastest one, which is most secure. Using a passphrase adds an extra layer of security. The key and cert I am not sure if just creating them from letsencrypt would solve this. And then the ca, I don't know what to do with that. Is that just something I download manually from letsencrypt? Or how do I get the certificate authority key? Or do I need it?

Then for the client, this is what I have:

const client = http2.connect('https://localhost:8443', {
//  ca: fs.readFileSync('ca-crt.pem')
    // rejectUnauthorized: false,
})

I was never able to get it working with these options. What do these options need to be? Do they need to be set to have the most secure client/server communication? For reference, the way my client will work is it will be installed on someones computer as a library, and then they will use it to internally make "secure" HTTP2 calls to the server. Do I just use some general CA here, or do I need to give each user a custom public or private key? If so, can I create that through letsencrypt too, or will that just be through OpenSSL probably? Or since I will be using Google Cloud, maybe using Google Cloud's private key generator system would be a good fit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.