Node.js 配置 SSL 证书完整教程

本文讲解 Node.js 配置 SSL 证书的完整流程，包括原生 HTTPS 模块和 Express 框架两种方式。

准备证书文件

建议准备：

• •/etc/ssl/example.com/fullchain.pem 包含服务器证书和中间证书
• •/etc/ssl/example.com/privkey.pem 私钥文件

限制私钥权限：

chown root:nodeapp /etc/ssl/example.com/privkey.pem
chmod 640 /etc/ssl/example.com/privkey.pem
chmod 644 /etc/ssl/example.com/fullchain.pem

创建 HTTPS 服务

const fs = require('node:fs');
const https = require('node:https');

const options = {
  key: fs.readFileSync('/etc/ssl/example.com/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/example.com/fullchain.pem'),
  minVersion: 'TLSv1.2',
};

https.createServer(options, (req, res) => {
  res.writeHead(200, {
    'Content-Type': 'text/plain; charset=utf-8',
  });

  res.end('HTTPS is working\n');
}).listen(443, '0.0.0.0', () => {
  console.log('HTTPS server listening on port 443');
});

Express 配置

const fs = require('node:fs');
const https = require('node:https');
const express = require('express');

const app = express();

app.get('/', (req, res) => {
  res.send('HTTPS is working');
});

https.createServer({
  key: fs.readFileSync('/etc/ssl/example.com/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/example.com/fullchain.pem'),
  minVersion: 'TLSv1.2',
}, app).listen(443, '0.0.0.0');

生产环境注意事项

Linux 的 443 是特权端口，不建议让 Node.js 以 root 身份运行。生产环境通常采用：

客户端 -> Nginx/负载均衡器:443 -> Node.js:3000

证书文件通过 readFileSync() 在进程启动时加载。证书续期后必须重载进程，例如：

pm2 reload app

或者：

systemctl restart node-app

验证

curl -I https://example.com

openssl s_client \
  -connect example.com:443 \
  -servername example.com \
  -verify_return_error