HTTP與HTTPS介紹
HTTP：超文本傳輸協議，是瀏覽器與服務器之間的通訊協議；
HTTPS：以安全爲目標的HTTP通道，可以簡單理解爲HTTP的安全升級版；
HTTPS與HTTP的區別
- https協議需要到ca申請證書，一般免費證書很少，需要交費。
- http是超文本傳輸協議，信息是明文傳輸，https 則是具有安全性的ssl加密傳輸協議。
- http和https使用的是完全不同的連接方式，用的端口也不一樣，前者是80，後者是443。
- http的連接很簡單，是無狀態的；HTTPS協議是由SSL+HTTP協議構建的可進行加密傳輸、身份認證的網絡協議，比http協議安全。
Windows下創建https服務器
~ D:\workspace\javascript>express -e nodejs-https
~ D:\workspace\javascript>cd nodejs-https && npm install
[email protected] node_modules\ejs
[email protected] node_modules\express
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected] ([email protected])
└── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected], [email protected])~ D:\workspace\javascript\nodejs-https>git --version
git version 1.8.1.msysgit.1
~ D:\workspace\javascript\nodejs-https>openssl version -a
OpenSSL 0.9.8e 23 Feb 2007
built on: Sat Sep 15 20:34:58 EDT 2007
platform: MSys
options: bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) blowfish(idx)
compiler: gcc -D_WINDLL -DOPENSSL_PIC -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DTERMIOS -DL_ENDIAN -D__CYGWIN__ -f
omit-frame-pointer -fnative-struct -O3 -mcpu=pentium -march=i486 -Wall -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -
DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
OPENSSLDIR: "/usr/ssl"使用openssl生成證書文件
#生成私鑰key文件：
~ D:\workspace\javascript\nodejs-https>openssl genrsa -out privatekey.pem 1024
Generating RSA private key, 1024 bit long modulus
...........................++++++
........++++++
e is 65537 (0x10001)
#通過私鑰生成CSR證書籤名
~ D:\workspace\javascript\nodejs-https>openssl req -new -key privatekey.pem -out certrequest.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:fens.me
Organizational Unit Name (eg, section) []:fens.me
Common Name (eg, YOUR name) []:Conan Zhang
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# 通過私鑰和證書籤名生成證書文件
~ D:\workspace\javascript\nodejs-https>openssl x509 -req -in certrequest.csr -signkey privatekey.pem -out certificate.pem
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=fens.me/OU=fens.me/CN=Conan Zhang/[email protected]
Getting Private key新生成了3個文件：certificate.pem, certrequest.csr, privatekey.pem
~ D:\workspace\javascript\nodejs-https>ls -l
total 17
-rwx------ 1 4294967295 mkpasswd 877 Dec 14 10:53 app.js
-rwx------ 1 4294967295 mkpasswd 956 Dec 14 11:22 certificate.pem
-rwx------ 1 4294967295 mkpasswd 704 Dec 14 11:21 certrequest.csr
drwx------+ 1 4294967295 mkpasswd 0 Dec 14 11:10 node_modules
-rwx------ 1 4294967295 mkpasswd 216 Dec 14 11:03 package.json
-rwx------ 1 4294967295 mkpasswd 887 Dec 14 11:20 privatekey.pem
drwx------+ 1 4294967295 mkpasswd 0 Dec 14 10:53 public
drwx------+ 1 4294967295 mkpasswd 0 Dec 14 10:53 routes
drwx------+ 1 4294967295 mkpasswd 0 Dec 14 10:53 views- privatekey.pem: 私鑰
- certrequest.csr: CSR證書籤名
- certificate.pem: 證書文件
修改啓動文件：app.js
var https = require('https')
,fs = require("fs");
var options = {
key: fs.readFileSync('./privatekey.pem'),
cert: fs.readFileSync('./certificate.pem')
};
https.createServer(options, app).listen(3011, function () {
console.log('Https server listening on port ' + 3011);
});啓動服務器
~ D:\workspace\javascript\nodejs-https>node app.js
Express server listening on port 3000
Https server listening on port 3011Linux下創建HTTPS服務器
~ openssl version -a
OpenSSL 1.0.1 14 Mar 2012
built on: Tue Jun 4 07:26:06 UTC 2013
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/usr/lib/ssl"
~ openssl genrsa -out privatekey.pem 1024
~ openssl req -new -key privatekey.pem -out certrequest.csr
~ openssl x509 -req -in certrequest.csr -signkey privatekey.pem -out certificate.pem修改文件app.js
var https = require('https')
,fs = require("fs");
var options = {
key: fs.readFileSync('./privatekey.pem'),
cert: fs.readFileSync('./certificate.pem')
};
https.createServer(options, app).listen(3011, function () {
console.log('Https server listening on port ' + 3011);
});啓動服務器
~ node app.js
Express server listening on port 3000
Https server listening on port 3011