节点 https ssl 你的连接不是私人错误

Question

我最近购买了一个 ssl 证书，当我访问我的网站时，我遇到了 google chrome 的问题，它显示“您的连接不是私有的 NET::ERR_CERT_AUTHORITY_INVALID”，这就是我正在做的事情：

const express = require("express");
const https = require('https');
const helmet = require("helmet");
const cors = require("cors");
const fs = require("fs");
const path = require("path");
const app = express();
const config = require("./config");
const passport = require("passport");
const credentials = { key: fs.readFileSync('ssl/site.key', 'utf-8'), cert: fs.readFileSync('ssl/site.crt', 'utf-8') + fs.readFileSync('ssl/site.ca-bundle', 'utf-8') };

app.use(helmet());
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(
  require("express-session")({
    secret: require("./config.json").app.secretKey,
    resave: false,
    saveUninitialized: true,
    cookie: {
      secure: false,
      maxAge: 60 * 60 * 1000 * 24 * 365,
    },
  })
);

app.use(passport.initialize());
app.use(passport.session());
passport.use(require("./service/passport"));

app.set("view engine", "ejs");
app.set("views", path.join(__dirname, "views"));
app.use(express.static(path.join(__dirname, "views")));

app.use("/", require("./api/views"));
app.use("/auth", require("./api/auth"));
app.use("/answer", require("./api/answer"));
app.use("/user", require("./api/views/user.view"));
app.use("/courses", require("./api/views/courses.view"));
app.use("/question", require("./api/views/question.view"));
app.use("/answer", require("./api/views/answer.view"));

app.use("/api/user", require("./api/user"));
app.use("/api/course", require("./api/course"));
app.use("/api/feedback", require("./api/feedback"));
app.use("/api/help", require("./api/help"));
app.use("/api/questions", require("./api/question"));

var httpsServer = https.createServer(credentials, app);

httpsServer.listen(config.app.port);

console.log(credentials);
//app.listen(config.app.port);

我看到很多人有同样的问题，我该怎么办？

Answer 1

显然需要几天时间才能将认证标记为安全，这是最后的代码：

const express = require("express");
const https = require('https');
const helmet = require("helmet");
const cors = require("cors");
const fs = require("fs");
const path = require("path");
const app = express();
const config = require("./config");
const passport = require("passport");
const credentials = { key: fs.readFileSync('ssl/site.key', 'utf-8'), cert: fs.readFileSync('ssl/site.crt', 'utf-8'), ca: fs.readFileSync('ssl/site.ca-bundle', 'utf-8') };

app.use(helmet());
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(
  require("express-session")({
    secret: require("./config.json").app.secretKey,
    resave: false,
    saveUninitialized: true,
    cookie: {
      secure: false,
      maxAge: 60 * 60 * 1000 * 24 * 365,
    },
  })
);

app.use(passport.initialize());
app.use(passport.session());
passport.use(require("./service/passport"));

app.set("view engine", "ejs");
app.set("views", path.join(__dirname, "views"));
app.use(express.static(path.join(__dirname, "views")));

app.use('/', require('./api/home'));
app.use("/auth", require("./api/auth"));
app.use("/answer", require("./api/answer"));
app.use('/material', require('./api/material'));
app.use("/user", require("./api/user"));
app.use("/courses", require("./api/course"));
app.use('/feedback', require('./api/feedback'))
app.use("/question", require("./api/question"));
app.use("/answer", require("./api/answer"));

var httpsServer = https.createServer(credentials, app);

httpsServer.listen(config.app.port);

我还使用了我通过 openssl 生成的证书，而不是我从网站收到的证书。

Answer 2

您需要将站点证书和中间证书收集到一个缓冲区中，并将该组合缓冲区作为cert 选项传递给https.createServer()。所以替换这个：

const credentials = { key: fs.readFileSync('ssl/key.pem'), cert: fs.readFileSync('ssl/crt.pem'), ca: fs.readFileSync('ssl/ceraut.ca-bundle') };

用这个：

const credentials = { key: fs.readFileSync('ssl/key.pem'), cert: fs.readFileSync('ssl/crt.pem') + fs.readFileSync('ssl/ceraut.ca-bundle') };

（这假定您的 ca-bundle 文件包含正确顺序和 PEM 格式的中间证书。）如果关闭换行符从网站证书文件不知何故丢失了。

根本不要将ca 选项传递给createServer()。该选项指定了一个非默认的根证书集合，用于验证收到的证书。您的服务器不需要该选项。

有关详细信息，请参阅https://nodejs.org/docs/latest-v10.x/api/tls.html#tls_tls_createsecurecontext_options 或相应 Node 版本的等价物，尽管准确的版本可能并不重要。这些选项的文档多年来一直很稳定。