nodejs - UNABLE_TO_VERIFY_LEAF_SIGNATURE with self-signed certificate

Question

I'm trying to make node https work with a self-signed certificate with a request coming to IP address instead of a DNS name. I'm using this code

var tls = require('tls');
var fs = require('fs');

var cert = fs.readFileSync(__dirname + '/cert.pem');
var key = fs.readFileSync(__dirname + '/key.pem');

var netServer = new tls.Server(options = { key: key, cert: cert });
var port = 54321;

netServer.listen(port);

netServer.on('secureConnection', function(socket) {
    socket.end('heyyyoooo');
});

var client = tls.connect(port, 'localhost', {
    ca: [ cert ],
    rejectUnauthorized: true
});

client.on('data', function(data) {
    console.log(data.toString());
    process.exit();
});

It works fine with the cert generated by these instructions (without Subject Alternative Names) when the request is issued to localhost, however when I replace it with 127.0.0.1, I get Error: Hostname/IP doesn't match certificate's altnames. So I've created a new certificate generating with subjectAltName. Openssl reads it as:

    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 11107838472034892631 (0x9a26f83d0c0ebb57)
        Signature Algorithm: sha1WithRSAEncryption
            Issuer: CN=127.0.0.1
            Validity
                Not Before: Jun 24 09:51:56 2013 GMT
                Not After : Jun 22 09:51:56 2023 GMT
            Subject: CN=127.0.0.1
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (1024 bit)
                    Modulus: *skipped*
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Key Usage: 
                    Key Encipherment, Data Encipherment
                X509v3 Extended Key Usage: 
                    TLS Web Server Authentication
                X509v3 Subject Alternative Name: 
                    DNS:localhost, IP Address:127.0.0.1
        Signature Algorithm: sha1WithRSAEncryption
*skipped*

So the SANs were created properly. Now I'm getting Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE, how do I make it work?

Possible duplicate of [How to add custom certificate authority (CA) to nodejs](https://stackoverflow.com/questions/29283040/how-to-add-custom-certificate-authority-ca-to-nodejs) — OrangeDog, May 11 '18 at 15:10

score 2 · Answer 1 · answered Nov 01 '13 at 20:07

2

Try this:

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';

answered Nov 01 '13 at 20:07

Formiga

113
1
12

15

Please note that this disables very important security checks. – oLeduc Mar 18 '15 at 15:30

nodejs - UNABLE_TO_VERIFY_LEAF_SIGNATURE with self-signed certificate

1 Answers1