How to write a proper HTTPS header? - node.js

Question

I've built a NodeJS TCP server that sits on secured port 443.
Instead of sending HTTP snippets, I am using 443 to send my custom data through.
It all works ok, until someone tries to navigate to the https address of node server.
Like to ask how do I send a 404 Not Found HTTPS response if someone were to navigate to the https address of my node server?
E.g:
if( isHTTPRequest ) {
socket.write("HTTP/1.1 404 Not Found");
return;
}
Above doesn't work.

Answer 1

There's nothing magic about port 443; it doesn't intrinsically make things secure. It's functionally the same as port 442, 444, 80, or any other. The only thing that's special about 443 is that by convention, HTTPS servers listen on that port.
The thing that makes HTTPS servers secure is that they implement the TLS protocol. TLS is a cryptographic protocol that provides an application a secure communication channel. TLS provides the security; the server then runs regular HTTP on top of the TLS channel.
TLS isn't just limited to HTTP servers. Any application can use it; its high-level APIs provide a data stream that works just like a regular TCP stream.
Fortunately, node includes a complete TLS implementation that is almost entirely API-compatible with a regular TCP stream provided by the net module. So instead of:
net.createServer(function(socket) {
socket.write('stuff that gets sent in the clear');
});
Do this:
tls.createServer({
cert: fs.readFileSync('cert.pem'), // the pem-encoded certificate
key: fs.readFileSync('key.pem'), // the private key that goes with your cert
ca: [] // you may need to include the CA's intermediate certs if applicable
}, function(socket) {
socket.write('stuff that will be encrypted');
});
Likewise, clients use tls.connect() instead of net.connect().
You generate your private key using OpenSSL, then submit a CSR to a Certificate Authority, who will give you a certificate that will be broadly accepted. You can also self-sign, but self-signed certificates won't be accepted by clients by default.
Finally, given that you're writing a custom server (not a HTTP server), you shouldn't be listening on port 443. Convention says that HTTPS servers listen on port 443, and your custom protocol isn't HTTP. Select a different port, preferably one that isn't already assigned.

Answer 2

You could let openssl client do the hard part. Check out their documentation and examples.