Implementing TLS Servers and Clients

Transport Layer Security/Secure Sockets Layer (TLS/SSL) is a cryptographic protocol designed to provide secure communications on the Internet. It uses X.509 certificates along with session keys to verify whether the socket server you are communicating with is the one you are intending to communicate with. TLS provides security in two main ways. First, it uses long-term public and secret keys to exchange a short-term session key so that data can be encrypted between client and server. It also provides authentication so that you can ensure that the webserver you are connecting to is the one you actually think it is, thus preventing man-in-the-middle attacks, in which requests are rerouted through a third party.

The following sections discuss implementing TLS socket servers and clients in your Node.js environment, using the tls module. Before getting started using TLS, you need to generate a private key and a public certificate for both your clients and your server. There are several ways to do this, depending on your platform. One of the simplest methods is to use the OpenSSL library for you platform.

To generate a private key, first execute the following OpenSSL commands to generate a private key:

openssl genrsa -out server.pem 2048

Next, use the following command to create a certificate-signing request file:

openssl req -new -key server.pem -out server.csr


Note

When creating the certificate-signing request file, you need to answer several questions. When prompted for the common name, you should enter in the domain name of the server you want to connect to. Otherwise, the certificate will not work. Also, you can enter additional domain names and IP addresses in the Subject Alternative Names field.


Then, to create a self-signed certificate that you can use for your own purpose or for testing, use the following command:

openssl x509 -req -days 365 -in server.csr -signkey server.pem -out server.crt


Note

The self-signed certificate is fine for testing purposes and internal use. However, if you are implementing an external web service that needs to be protected on the Internet, you may want to get a certificate signed by a certificate authority. If you want to create a certificate that is signed by a third-party certificate authority, you need to take additional steps.


..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.219.109.173