我是node.js的新手,并且正在运行一个简单的https服务器。现在,当用户请求某个上下文路径时,服务器应启动SSL重新协商并请求客户端证书认证。我看到在node.js 0.11.8及更高版本中支持此功能。
到目前为止,我已尝试过此操作,但没有进行重新协商。甚至不会引发错误。
var https = require('https');
var fs = require('fs');
var optSsl = {
key: fs.readFileSync('ssl/server/keys/server.key'),
cert: fs.readFileSync('ssl/server/certs/server.crt'),
ca: fs.readFileSync('ssl/ca/ca.crt'),
requestCert: false,
rejectUnauthorized: true,
ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS',
honorCipherOrder: true
};
var optClientAuth = {
requestCert: true,
rejectUnauthorized: true
};
var server = https.createServer(optSsl, function(req, res){
res.writeHead(200);
res.end("Hello World\n");
});
server.on('request', function(req, res){
console.log('request emitted on ' + req.url);
if (req.url == '/secure') {
try {
var socket = req.connection;
socket.renegotiate(optClientAuth, function(err){
if (!err) {
console.log(req.connection.getPeerCertificate());
} else {
console.log(err.message);
}
});
} catch (err) {
console.log(err);
}
};
});
server.on('secureConnection', function(socket) {
console.log('Secure connection established');
});
server.listen(8443);
谢谢您的支持。
最佳答案
这是对我有用的代码。
var https = require('https');
var fs = require('fs');
var constants = require('constants');
var optSsl = {
key: fs.readFileSync('./server.key'),
cert: fs.readFileSync('./server.crt'),
ca: fs.readFileSync('./ca.crt'),
passphrase: "very_secret",
agent: false,
requestCert: false,
rejectUnauthorized: false,
ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS',
honorCipherOrder: true,
secureOptions: constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_SSLv2
};
var optClientAuth = {
requestCert: true,
rejectUnauthorized: true
};
var server = https.createServer(optSsl);
server.on('request', function(req, res){
console.log('request emitted on ' + req.url);
var socket = req.connection;
if (req.url == '/secure') {
var result = socket.renegotiate(optClientAuth, function(err){
if (!err) {
console.log(req.connection.getPeerCertificate());
res.writeHead(200);
res.end("Authenticated Hello World\n");
} else {
console.log(err.message);
}
});
} else {
res.writeHead(200);
res.end("Secured Hello World\n");
};
});
server.listen(8443);
关于javascript - 如何在Node.js 0.11.8及更高版本中使用tlsSocket.renegotiate(options,callback),我们在Stack Overflow上找到一个类似的问题:https://stackoverflow.com/questions/25769108/