I have a website running on a nodejs server. The website contacts an API which is present on another server. Now, I want to make the connection secure by using SSL. So, I have a self-signed certificate on the API server. My question is that how do I make the nodejs server trust thes self-signed certificate and accept a connection to it.
Related
I have two apps (iOS and Android) connecting to a WebSocket connection (ws). But now I also have a web application running over HTTPS, and it is not connecting (from what I've seen because HTTPS needs wss to connect).
My question is how can I add a certificate to the connection?. Can I use the same certificate I'm using for my site, and if so, how?
I'm using zeroSSL for the certificates, should I create a new one?
Thanks in advance!
I moved my stack(nodejs based restapi, UI/UX asp.net mvc by another team) to production mode on AWS.
I have an issue with ssl certificate.
The ssl certificate i use on nodejs is self signed as a result i get "certificate not trusted" issue on the browser while trying to access the client.
When i was looking for IP based CA certificates, i realized it can be issued only for organization based IPs.
Since i am hosting the nodejs server on ec2 this ip doesnt belong to my organization. Please let me know what is the best way out of this
For testing purposes I would like to enable the 'Incoming Client Certificates' option in my Azure App Service (running a WCF webservice), and see if my Client application can still connect to the webservice. Since I am still in a testing phase, my app service still has the .azurewebsites.net domain name.
However, I can't seem to figure out how to get a proper client certificate that the server will accept (without switching to a custom domain name, which I know will work).
Currently, I see 2 possible routes to a solution:
Somehow get my hands on .cer that is signed by a CA trusted by the App Service server.
Generate a self-signed .pfx and .cer with my own self-signed CA. Import the pfx on the App Service and install the .cer on the client.
Both directions have not yielded any success so far. Does anyone have any experience with this?
Per my understanding, the client certificate is used by client systems to make authenticated requests to a remote server. In this case, your webservice is the remote server in a C/S mode. As you point out, "validating this certificate is the responsibility of the web app. So this means that any certificate will be valid as long as you don't validate anything". It does not effect on whether you have a custom domain or not in your web app service.
If you want to use client cert authentication with Azure app, you can refer to How To Configure TLS Mutual Authentication for Web App.
If the server has requested client certificate in its server hello and the client cert has signing capability, then it is expected to send the CertificateVerify message to the server. It contains signed hash of all messages from Client Hello till that point which are buffered on the server side. The server TLS layer will decrypt this using the client public key (which is in the Client certificate received earlier) and compare with its calculated hash. It will call back to application layer if this fails.
The application needs to handle it at that point and return its own error or continue with the session. https://www.rfc-editor.org/rfc/rfc5246#section-7.4.8
One example of this with Wolfssl library is https://github.com/wolfSSL/wolfssl/blob/14ef517b6113033c5fc7506a9da100e5e341bfd4/wrapper/CSharp/wolfSSL-Example-IOCallbacks/wolfSSL-Example-IOCallbacks.cs#L145
I have the SSL certificate from the rapid SSL and Rapid SSL issued the certificate to the server.
Now I have 4 files.
CACertificate-INTERMEDIATE-1.cer
CACertificate-ROOT-2.cer
PKCS7.p7b
CACertificate-INTERMEDIATE-1.cer
ServerCertificate.cer
Then how to configure the server to it.
If I understood you correctly, you want to setup HTTPS for you node.js web server.
If you are using plain node.js, then you will have to switch from http module to https module. Take a look at the docs: https://nodejs.org/dist/latest-v8.x/docs/api/https.html#https_https_createserver_options_requestlistener
If you are using some kind of a framework, you will need to consult its docs.
Usually you need a server certificate and a corresponding private key. The files that you were provided with look like a certificate chain (root CA cert -> intermediate CA cert -> your server cert). The files name ServerCertificate.cer conveys a feeling that it is a server certificate. But where is your private key file? You should consult certificate issuer to find this out.
ssl-root-cas module helps to use custom certifcates on your node.js server.
You can inject your custom certificate doing:
require('ssl-root-cas').addFile('my-cert.crt');
Have a look to this article that explains how to use ssl/tls certifcates on your node.js app:
https://www.sitepoint.com/how-to-use-ssltls-with-node-js/
I have website hosted on IIS. My main issue is that I want only users with a specific certificate installed to be able to access the site. I tried to follow some tutorials but I can't find anyone covering both server and client side, since I can't get it to work.
I have some questions to the main issue:
What kind of certificate should I use (domain/selfed signed in IIS 7.5)? I do have access to a Active Directory Certificate Services where I can create other types of certificates (CA), but the problem is when trying to import them to my IIS ("certificate cannot be used as an ssl server certificate")
I would like to use a CA certificate, but is that possible when using IIS? Or do I need to write all the code the check if the user has the right certificate?
When created a certificate for the website (e.g. though IIS)..How do I create user certificates that are trusted by the server certificate?
As you may noticed by now I'm not sure how to do all of this, and would really like some help..
Server should use SSL server certificate. This certificate has to have Server Authentication extension in Extended key usage. Server certificate should have SAN extension (Subject alternative name) with domain name of server as DNS name (i.e. somesite.com)
CA certificate has to be imported to Trusted root store (preferably Local Machine) on both server and client machines.
Client certificate should contain Client Authentication extension in Extended key usage.
All EndEntity (client and server) certificates should have CRL distribution point in them where there is URL to CRL that is issued by CA. CRL has to be accessible by both client and server and should be always valid.
You can use XCA for training purposes. It has a nice GUI and it has templates for CA, SSL server and SSL client certificates by default. Then you can mimic these certificates in your Active Directory Certificate Services. Documentation and some guides can be found here.