的NodeJS - UNABLE_TO_VERIFY_LEAF_SIGNATURE使用自簽名證書

Question

我試圖使節點https工作用的請求來IP地址而不是DNS名稱的自簽名證書。我使用這個代碼

var tls = require('tls'); 
var fs = require('fs'); 

var cert = fs.readFileSync(__dirname + '/cert.pem'); 
var key = fs.readFileSync(__dirname + '/key.pem'); 

var netServer = new tls.Server(options = { key: key, cert: cert }); 
var port = 54321; 

netServer.listen(port); 

netServer.on('secureConnection', function(socket) { 
    socket.end('heyyyoooo'); 
}); 

var client = tls.connect(port, 'localhost', { 
    ca: [ cert ], 
    rejectUnauthorized: true 
}); 

client.on('data', function(data) { 
    console.log(data.toString()); 
    process.exit(); 
}); 

它正常工作與these instructions生成的證書（無主題備用名稱），當請求發出到localhost，但是當我用127.0.0.1取代它，我得到Error: Hostname/IP doesn't match certificate's altnames。所以我創建了一個由subjectAltName生成的新證書。 OpenSSl將其讀爲：

Certificate: 
     Data: 
      Version: 3 (0x2) 
      Serial Number: 11107838472034892631 (0x9a26f83d0c0ebb57) 
     Signature Algorithm: sha1WithRSAEncryption 
      Issuer: CN=127.0.0.1 
      Validity 
       Not Before: Jun 24 09:51:56 2013 GMT 
       Not After : Jun 22 09:51:56 2023 GMT 
      Subject: CN=127.0.0.1 
      Subject Public Key Info: 
       Public Key Algorithm: rsaEncryption 
        Public-Key: (1024 bit) 
        Modulus: *skipped* 
        Exponent: 65537 (0x10001) 
      X509v3 extensions: 
       X509v3 Key Usage: 
        Key Encipherment, Data Encipherment 
       X509v3 Extended Key Usage: 
        TLS Web Server Authentication 
       X509v3 Subject Alternative Name: 
        DNS:localhost, IP Address:127.0.0.1 
     Signature Algorithm: sha1WithRSAEncryption 
*skipped* 

因此，SAN已正確創建。現在我得到Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE，我該如何使它工作？

Answer 1

試試這個：

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';