Now our server will respect the certificate revocation list so we should now see client2 rejected while client1 is still accepted! var fs = require('fs') var https = require('https') var options = ).listen(4433) This is your standard HTTPS server in Node.js. Next, let’s build a basic HTTPS server using the certificate and listen on 0.0.0.0:4433. Our server certificate is all set and ready to go! Server openssl x509 -req -extfile server.cnf -days 999 -passin 'pass:password' -in server-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out server-crt.pem Now let’s sign the request using the certificate authority we created previously.

openssl req -new -config server.cnf -key server-key.pem -out server-csr.pem Now we’ll generate the certificate signing request. Again to simplify configuration, let’s use server.cnf as a configuration shortcut. Our next move is to generate a certificate signing request. Now that we have our certificate authority in ca-key.pem and ca-crt.pem, let’s generate a private key for the server. openssl req -new -x509 -days 9999 -config ca.cnf -keyout ca-key.pem -out ca-crt.pem Next, we’ll create a new certificate authority using this configuration. To simplify the configuration, let’s grab the following CA configuration file. (let’s also use it to sign our server certificate so we don’t have to pay a public certificate authority) First we’ll build a Certificate Authority to sign our own client certificates. Let’s walk through the process of creating certificates and build an HTTPS server and client to use them. Here’s some background on how Client-authenticated TLS Handshakes work over at Wikipedia. This strategy can be used in API services instead of (or in addition to) another form of identity such as shared secrets or OAuth. This forces the client to present a valid certificate before the negotiation can continue. However the server can be configured to challenge the client with a CertificateRequest during the TLS handshake.

Typically HTTPS servers do a basic TLS handshake and accept any client connection as long as a compatible cipher suite can be found. But we were surprised to find that we could quickly add client x.509 certificate checking in just a few lines of code. If you build Node.js HTTPS servers as much as we do, you’ll know how easy it is to get things going.

Node http client