如何从Node.js中的wosign使用SSL证书

Question

I'm trying to use a free ssl certificate(s?) I got from wosign in node.js, but I'm having some issues.

I'm creating my server with:

 var server = https.createServer({key: serviceKey, cert: certificate}, httpHandler).listen(port)

which works fine with my self-signed certificate. To allow wosign to generate a certificate, I gave them the CSR that was generated alongside my self-signed certificate. They gave me the following files:

• root.crt
• 3_user_my.domain.crt
• 2_issuer_Intermediate.crt
• 1_cross_Intermediate.crt

I've also read through the following couple sources to help me along:

• https://www.ohling.org/blog/2015/02/wosign-free-2y-ssl-certificate.html
• http://www.lowendtalk.com/discussion/41289/free-chinese-2-year-ssl-certificate-dv-kuaissl-by-wosign-com

Both mention that the "order" of the certificates is important, but I don't know what they mean there. I assumed that there would be a single certificate I could replace my self-signed certificate with. If there's an order, I assume it goes 1->2->3 as those numbers are in the filenames.

I replaced my certificate with the 3_user_my.domain.crt contents, and it works like my self-signed one - chrome says it should only work on localhost.

So how do I "order" these certs and ultimately how do I use the files given to me so that browsers will recognize it correctly?

Answer 1

Ok, I got it working.

A . I learned that the "certificate" used actually can be multiple certificates (crt files that only have one -----BEGIN CERTIFICATE----- and one -----END CERTIFICATE----- . So in order to make it work right, I needed to create one certificate file/string that contained 3 of the 4 certificates I got in the right order (apparently the root.crt isn't useful)

B1 . The English set of certificate wosign gave me didn't match my private key, which I verified using the following:

openssl x509 -noout -modulus -in yourcertificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5
# If both outputs match, the cert matches the key, otherwise they don't

B2 . So I chose the chinese certificate option, and there was a much different set of certs in the archive I got from that. I used the bundled cert for NGINX. And that works!