如何获得在VPS服务器上的Windows VM上运行的NodeJS Express API的有效SSL证书？

Question

I'm setting up a Web API based on NodeJS and want to support HTTPS. Where can I get a valid SSL certificate?

I have a Windows VM running on a given IP address that is hosting a NodeJS API on a specific port. Everything works fine via HTTP but when I change it to HTTPS I get this error: ERR_CERT_COMMON_NAME_INVALID

https://i.ibb.co/cxvmZBf/Capture.png (Sorry, not enough reputation points)

I've tried many approaches including using a valid certificate associated with a sub-domain and redirecting it to the VM's address. Also, I've created a DNS Type A, and configured the given IP address. Then, with Let's Encrypt Certbot I've tried to generate a valid non-signed certificate but I've reached inconclusive errors due to incompatible IP settings.

Is it possible to buy a certificate to the given IP? If so, where? What other approaches can I try?

Answer 1

As we can see in the browser error, currently your application does not have any server certificate configured in it.

To get a certificate you can generate a CSR using a tool like openssl cli or an online tool, send it to a well known CA and use the signed certificate as you server certificate for the NodeJS API.

It's described in the NodeJS documentation how to configure the server certificates (.pem files):

// curl -k https://localhost:8000/
const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('test/fixtures/keys/agent2-key.pem'),
  cert: fs.readFileSync('test/fixtures/keys/agent2-cert.pem')
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('hello world\n');
}).listen(8000);

Answer 2

You may use this tool to generate a self signed certificate and include in your Application. Or else you can copy the command and generate certificates on your own using openssl cli.

A sample command to generate your own certificate with X.509 standard is:

openssl req -new -newkey rsa:2048 -x509 -nodes -keyout key.pem -out certificate.pem -sha256 -days 750 -subj "/C=IN/ST=/L=/O=TCS/OU=CTO/CN=YOURDOMAIN" -config <(
cat <<-EOF
[req]
default_bits = 2048
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
[ req_ext ]
basicConstraints=CA:FALSE
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = ALTERNATEDNS1
DNS.2 = ALTERNATEDNS2
EOF
)

You may also go for verified certificate issued by different Certificate Authorities (CA), For more info click here