使用SSL保护来自节点的服务调用

Question

I am trying to securing the service calls that are made from my node to other services secure. All the other services have enabled https. I tried the following methods

1. process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'

which as per my understanding ignores all error so removed from the code becuase of certificates

2. I am using request module. where we can configure

   key - provided my private key file,

   cert - provided my certificate file

   ca - certificate authorty chain

   then it was throwing UNABLE_TO_VERIFY_LEAF_SIGNATURE

I found out that node doesn't read ca from the system. it has its own ca chain So I included node-ssl-root-cas which fetched latest cas from internet.

Then using ssl-analyser, i was able to find my domain doesn't have intermediate ca certificate

I downloaded that from our ca and made a ca chain and attached it to ssl-root-cas

Then i was able to make requests successfully

But Even if I remove key and cert from my request i am able to make request and get result.

How can I check my request and response are actually encrypted?

Or node just ignoring errors,

Answer 1

FYI, Node will use the certificate auhtorities installed on the system if you don't provide your own with the "ca" property. When you do provide your own, the system ones are ignored. This is by design, as providing your own CA likely means that you want to only trust certificates signed by your own CA. If you aren't using your own CA, you can skip setting the "ca" property. If you are, then I'm not sure why you would need to provide the full list of commonly trusted CAs as well. That seems like a pretty odd use case.

You can use the https module to make requests without providing your own key and cert. This is expected and documented behaviour. For technical reasons, when making any https requests, more specifically opening any TLS socket, the client also needs to have a private key and certificate. In the default case, the server doesn't verify the client in any way, so browsers use what's commonly referred to as a "snakeoil" certificate - a bundled self signed certificate.

The use case for providing your own key and cert when performing https requests, is when the server has client certificate checks enabled. For example, when connecting to Apple's servers for delivering push messages to iOS, you have a client certificate issued by Apple that Apple's servers uses to verify that you have access to send push messages (the certificate was issued by Apple) and which app you are sending to (the fingerprint/checksum of the certificate).

Unless the https services you talk to require specific client certificates, you're better off not setting "key" and "cert" - there's no real reason to do that.

So, in summary, you can probably skip setting all three of key, cert and ca, as the real problem seemed to be your mis-configured server (it didn't serve the CA chain).