无法信任 Node.js 中来自 IIS Express 的自签名 SSL 证书

Question

我在使用 Windows 上的 Node.js 使用自签名证书访问在 IIS Express 中本地运行的 HTTPS 站点时遇到问题。重现代码：

const https = require("https");

const req = https.request(
  {
    hostname: "localhost",
    path: "/api/heroes",
    port: 44323,
    method: "GET"
  },
  res => res.on("data", console.log)
);
req.on("error", console.error);

使用node test.js 运行它会得到：

Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1321:34)
    at TLSSocket.emit (events.js:223:5)
    at TLSSocket._finishInit (_tls_wrap.js:794:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:608:12) {
  code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}

我可以毫无问题地在 Chrome 中访问该页面； Chrome 将证书视为受信任的。我还在当前用户的受信任的根证书颁发机构下的certmgr 中看到了证书。我尝试将证书导出为 PEM，然后将 NODE_EXTRA_CA_CERTS 指向它；我还尝试创建一个 https.Agent 并通过读取证书设置其 ca 属性。两者都给出相同的错误。

使用 `openssl x509 -in cert.pem -noout -text 查看证书会得到以下结果：

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:16:7e:86:ce:1a:56:97:48:62:21:cc:7f:ce:ac:55
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=localhost
        Validity
            Not Before: Oct  6 02:20:56 2018 GMT
            Not After : Oct  5 00:00:00 2023 GMT
        Subject: CN=localhost
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:db:6c:55:9e:a5:a8:83:7f:ed:0b:62:88:9c:16:
                    05:31:64:fe:e7:23:73:0a:9e:5e:49:90:c8:ca:98:
                    b5:96:52:ad:36:79:17:81:54:bd:99:99:a1:c3:d3:
                    94:e3:34:83:24:ae:64:e4:33:a7:70:cf:fd:a1:91:
                    df:fb:c4:e5:62:c1:5a:ab:dd:42:e2:b3:33:38:99:
                    9a:be:10:a4:9a:a7:aa:a6:30:59:a6:29:25:3f:95:
                    2f:7e:c8:79:42:8f:d5:54:c1:2b:5e:91:3c:7c:53:
                    e2:34:68:51:21:f2:1a:71:66:78:1c:fc:93:f7:f8:
                    7e:70:43:22:4f:53:8c:5a:9b:08:ef:d4:af:79:b1:
                    be:be:7c:bd:cf:04:9b:30:7f:a7:19:f6:dc:3c:30:
                    b2:6f:83:fd:45:65:1c:2e:66:ad:d6:fc:d6:3d:09:
                    60:53:32:c7:13:24:80:44:25:05:81:41:61:f0:65:
                    32:1a:1b:b2:c7:a0:bb:52:d9:a9:5d:75:4d:d8:ac:
                    6a:d6:e2:97:d8:e0:cc:1b:1e:bf:05:e6:c5:11:69:
                    89:c8:c4:d1:fe:8c:d2:f6:f0:04:bb:38:c7:50:7f:
                    a7:78:80:03:27:a6:86:86:78:d7:5d:d3:cb:47:09:
                    b6:f6:ca:a2:c8:51:95:e2:85:3d:46:74:4f:50:b2:
                    7f:75
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Digital Signature, Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:localhost
    Signature Algorithm: sha256WithRSAEncryption
         45:c4:44:60:e6:bc:a2:8f:8f:db:5e:7c:33:14:a6:59:d7:7e:
         ef:88:e6:75:21:dc:df:3e:3b:be:7c:0e:c7:f4:1e:84:0c:56:
         05:78:41:08:7a:97:f7:47:d9:6f:91:39:b3:9f:0b:b2:e0:c9:
         49:08:3b:9a:80:fd:07:3d:cc:55:21:d2:52:27:f3:a0:f2:35:
         a8:0c:56:0d:4b:c9:20:e1:94:8d:43:b6:f3:72:55:5e:0d:27:
         55:0e:b5:72:26:90:65:fb:28:98:87:bd:c8:68:d5:44:a6:69:
         af:0b:2e:20:e2:4c:7b:50:68:9d:25:56:3c:0d:2d:b9:54:0b:
         21:cf:71:f5:92:ad:b5:72:8f:88:3e:d5:3f:54:40:58:d3:1c:
         40:99:3a:1f:59:40:81:52:39:55:cf:2f:7e:18:27:86:6b:67:
         82:c3:d0:2d:93:91:b3:5b:02:b5:3a:8a:46:90:93:20:ed:09:
         4e:7a:37:f6:21:2b:84:5d:eb:bc:96:63:cd:08:24:4a:0d:ee:
         8a:86:d3:6c:f8:3c:0d:4f:6a:a7:e1:ca:17:83:bb:5e:99:ff:
         87:19:a1:d5:b9:b9:54:59:41:44:32:36:20:bd:3f:4d:ad:6d:
         4f:11:c6:76:77:2d:d7:9e:21:17:eb:d5:fd:a2:58:0a:dc:1d:
         14:5e:d2:f3

我知道有一些解决方法涉及禁用检查证书（或仅在本地纯 HTTP 上运行 API），但我真的很好奇和困惑为什么它不能与 HTTPS 一起使用。非常感谢任何帮助。

Answer 1

根据定义，自签名证书不受信任。

我建议使用let's encrypt：它是一个开源项目，完全免费，非常容易设置，它可以让您避免浪费时间进行奇怪的黑客攻击。

这帮我节省了很多时间。

希望这会有所帮助。