How to setup a secure private web server with node.js using SSL authorization
gist.github.com
gist.github.com
I read this and did not understand:
When you use the rogue certificate and rejectUnauthorized == false, you should see a TLS error being printed on the console, remeber to set rejectUnauthorized == true, to protect the web server.
Are you talking about if(!cleartextStream.authorized) part?
Yes that is exactly what I meant. If the rejectUnauthorized flag is set, the connection will be dropped before the event 'secureConnection' is emitted, so you will never be able to pick it up if you want to for testing. But in production it is important to enable it, to make sure that connections are dropped.
I have been missing a way that OpenVPN certs, configs, and instructions could be distributed to users without obscuring their general usefulness as SSL certs. Thanks!