nxtedition/node-http2-proxy

Add "ca", "key", "cert" options and "rejectUnauthorized" options for TLS-based HTTP servers using self-signed certificates.

masx200 opened this issue · 10 comments

ronag commented

Add where? This library doesn't create the http server.

masx200 commented

These options are the options that the TLS client can pass in when creating a tls connection. You can see the nodejs documentation.

ronag commented

I still don't see where in the api for this library you would like this? Can you provide an example on how you would like to use it?

masx200 commented 
const tls = require('tls');
const fs = require('fs');

const options = {
  // Necessary only if the server requires client certificate authentication.
  key: fs.readFileSync('client-key.pem'),
  cert: fs.readFileSync('client-cert.pem'),

  // Necessary only if the server uses a self-signed certificate.
  ca: [ fs.readFileSync('server-cert.pem') ],
rejectUnauthorized:false,
  // Necessary only if the server's cert isn't for "localhost".
  checkServerIdentity: () => { return null; },
};

const socket = tls.connect(8000, options, () => {})
ronag commented

@masx200: that example has no relation to this library in its current form

masx200 commented 
server.on('request', (req, res) => {
  proxy.web(req, res, {
ca:[ fs.readFileSync('server-cert.pem') ],
rejectUnauthorized:false,
protocol:"https",
    hostname: 'localhost'
    port: 9000
  }, defaultWebHandler)
})
masx200 commented

https://github.com/villadora/express-http-proxy#q-how-can-i-support-non-standard-certificate-chains

Q: How can I support non-standard certificate chains?
You can use the ability to decorate the proxy request prior to sending. See proxyReqOptDecorator for more details.

app.use('/', proxy('internalhost.example.com', {
  proxyReqOptDecorator: function(proxyReqOpts, originalReq) {
    proxyReqOpts.ca =  [caCert, intermediaryCert]
    return proxyReqOpts;
  }
})
Q: How to ignore self-signed certificates ?
You can set the rejectUnauthorized value in proxy request options prior to sending. See proxyReqOptDecorator for more details.

app.use('/', proxy('internalhost.example.com', {
  proxyReqOptDecorator: function(proxyReqOpts, originalReq) {
    proxyReqOpts.rejectUnauthorized = false
    return proxyReqOpts;
  }
}))
ronag commented 
  proxy.web(req, res, {
    hostname: 'localhost'
    port: 9000,
    onReq: (req, options) => http.request(options)
  }, defaultWebHandler)
masx200 commented 
  proxy.web(req, res, {
    hostname: 'localhost'
    port: 9000,
    onReq: (req, options) => http.request(options)
  }, defaultWebHandler)

Such use will make the novice very confused. Novices ca n’t find how to set options to support servers that use self-signed certificates.

ronag commented

Such use will make the novice very confused. Novices ca n’t find how to set options to support servers that use self-signed certificates.

Sure, PR is welcome.