每个节点服务器多个 SSL 证书

Question

We want to support the landing pages created on our website to be served over https on the custom domains that our user wish to server the page. So we can have the separate SSL certificate for our each user and we have a node server. We want to achieve the below things:

1) Attach multiple SSL certificates with node server. 2) We need a way to attach the certificates at any instance of time to the server eg. whenever we got a domain from our customers.

Answer 1

Let's Encrypt w/ Greenlock Express v3

I'm the author if Greenlock Express, which is Let's Encrypt for Node.js, Express, etc.

I'm still in the middle of writing the v3 documentation (lots of broken links to examples that haven't been converted from v2 yet), but the setup looks a little like this:

require("greenlock-express")
    .init(function getConfig() {
        return {
          package: require("./package.json")
          manager: 'greenlock-manager-fs',
          cluster: false,
          configFile: '~/.config/greenlock/manager.json'
        };
    })
    .serve(httpsWorker);

function httpsWorker(server) {
    // Works with any Node app (Express, etc)
    var app = require("./my-express-app.js");

    // See, all normal stuff here
    app.get("/hello", function(req, res) {
        res.end("Hello, Encrypted World!");
    });

    // Serves on 80 and 443
    // Get's SSL certificates magically!
    server.serveApp(app);
}

It uses http2 by default on node v12+, and also works with node cluster so that you can take advantage of multiple cores.

It uses SNICallback to dynamically add certificates on the fly.

Site Management

The default manager plugin uses files on the file system, but there's great documentation on how to build your own.

Just to get started, the file-based plugin looks like this:

~/.config/greenlock/manager.json :

{
    "subscriberEmail": "letsencrypt-test@therootcompany.com",
    "agreeToTerms": true,
    "sites": [
        {
            "subject": "example.com",
            "altnames": ["example.com", "www.example.com"]
        }
    ]
}

Key and Certificate Management

Likewise, the default Key and Cert plugin is filesystem-based (actually based on certbot, from the early days), but there's a plugins for connecting to databases ( greenlock-store-sequelize ) so that you can manage your certs however you like.

The default plugin stores them in ~/.config/greenlock/ .

DNS-01 and HTTP-01 challenge plugins

There are plugins for various DNS providers (Name.com, NameCheap, DNSimple, GoDaddy, etc), and there's a test suite that makes it easy to write the couple of callbacks you need to make your own:

• Greenlock HTTP-01 docs
• Greenlock DNS-01 docs

Management API

There's already an API, which I won't document here because I'm busy (right now) writing the official documentation for it, but essentially you'll do something like this:

greenlock.add({
  subject: 'example.com',
  altnames: ['example.com', '*.example.com']
})

There are some CLI tools in the works, and Greenlock Pro, forthcoming, will have a UI for it, as well as routing tools (ie serve domain X from this directory, proxy domain Y to port 2345 with websocket support enabled, etc)

I'll be back

Once I have more of the official docs ready, I'll come back and add some updates here.

Feel free to contact me on Keypairs. I'm @coolaj86 there.

Answer 2

1) Attach multiple SSL certificates with node server. 2) We need a way to attach the certificates at any instance of time to the server eg. whenever we got a domain from our customers.

Managing such dynamic configuration at an instance is really hard to update and maintain. As suggested in comment go for LB and place LB on the top of EC2 instance and handle certificate and New Domain integration with AWS SDK.

In high-level flow will be

Attach multiple SSL certificates with node server

• Place LB on top of each instance and you will not need to manage SSL at instance level and AWS will take care of it. Also, you will be saving CPU cost by putting this SSL encrypt and decrypt load on LB.

whenever we got a domain from our customers.

• using AWS SDK, create a request for new ACM
• Once certificate approved, update AWS LB certificate list from SDK or manually but better to for automation.