How to create .pem files for https web server

Question

I'm using the Express framework in Node.js to create a web server. I want to use ssl for the web server's connection.

The code to create the https web server is as below.

var app = express.createServer({
  key: fs.readFileSync('./conf/key.pem'),
  cert: fs.readFileSync('./conf/cert.pem')
});
module.exports = app;

Question: How to create the key.pem and cert.pem required by express?

Solution 1

The two files you need are a PEM encoded SSL certificate and private key. PEM encoded certs and keys are Base64 encoded text with start/end delimiters that look like -----BEGIN RSA PRIVATE KEY----- or similar.

To create an SSL certificate you first need to generate a private key and a certificate signing request, or CSR (which also contains your public key).You can do this in a variety of ways, but here's how in OpenSSL.

openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem

This will cause you to enter an interactive prompt to generate a 2048-bit RSA private key and a CSR that has all the information you choose to enter at the prompts. (Note: Common Name is where you'll want to put the domain name you'll be using to access your site.) Once you've done this you would normally submit this CSR to a trusted certificate authority and once they've validated your request you would receive a certificate.

If you don't care about your certificate being trusted (usually the case for development purposes) you can just create a self-signed certificate. To do this, we can use almost the same line, but we'll pass two extra parameters.

openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem

This will give you a cert (valid for 10 years) and key pair that you can use in the code snippet you posted.

Solution 2

Just follow this procedure :

1. create the folder where you want to store your key & certificate :

   mkdir conf

---

2. go to that directory :

   cd conf

---

3. grab this ca.cnf file to use as a configuration shortcut :

   wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/ca.cnf

---

4. create a new certificate authority using this configuration :

   openssl req -new -x509 -days 9999 -config ca.cnf -keyout ca-key.pem -out ca-cert.pem

---

5. now that we have our certificate authority in ca-key.pem and ca-cert.pem, let's generate a private key for the server :

   openssl genrsa -out key.pem 4096

---

6. grab this server.cnf file to use as a configuration shortcut :

   wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/server.cnf

---

7. generate the certificate signing request using this configuration :

   openssl req -new -config server.cnf -key key.pem -out csr.pem

---

8. sign the request :

   openssl x509 -req -extfile server.cnf -days 999 -passin "pass:password" -in csr.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem

I found this procedure here, along with more information on how to use these certificates.

Comments

[nkint]

what about for client certificate and key?

[Ninjaxor]

This post is complete, run both of the two commands he pasted to win the keys+cert. The client doesn't establish trust, only the server.

[StormTrooper]

@paul Can you please tell me where are these .pem key and cert generated to? I mean which directory? I am using Ubuntu 14

[Paul Kehrer]

They'll write to the current working directory of your shell.

[Zhiyong]

Note that the self-signed certificate generated this way is version 1, containing CN, but no SAN. "Since version 58, Chrome requires SSL certificates to use SAN (Subject Alternative Name) instead of the popular Common Name (CN), thus CN support has been removed." [Fixing Chrome 58+ [missing_subjectAltName] with openssl when using self signed certificates](alexanderzeitler.com/articles/…)

[Sanchit Jain]

How do i do this in Windows

[Oliver Dixon]

No cert file is generated for me. Any ideas? Ran both commands.