http-party/create-servers

create-servers

Create an http AND/OR an https server and call the same request handler.

Usage

The create-servers module exports a function that takes a config object and a node-style callback. The config object must have at minimum an http or https property (or both). The following config properties are supported:

If successful, the create-servers callback is passed an object with the following properties:

Certificate Normalization

create-servers provides some conveniences for https.ca, https.key, and https.cert config properties. You may use PEM data directly (inside a Buffer or string) or a file name. When using a file name, you must also set an https.root config property if using relative paths to cert/key files.

https.ca, https.cert, and https.key also support specifying an Array. Given an array for cert, you must have a matching array for key so each cert can be matched with its private key.

const createServers = require('create-servers');

createServers({
  https: {
    root: '/cert/path',
    cert: ['cert1.crt', 'cert2.crt'],
    key: ['cert1.key', 'cert2.key']
  }
}, err => {
  // ...
})

If you have a cert that is signed by an intermediate CA, your server will need to append the untrusted parts of the CA chain with your cert. To make this more convenient, create-servers lets you use an array to automatically create a chain.

const createServers = require('create-servers');

createServers({
  https: {
    root: '/cert/path',
    cert: ['cert.crt', 'intermediate.crt'],
    key: 'cert.key'
  }
}, err => {
  // ...
})

If you are specifying multiple certs and you want to create chains for each, use an array of arrays.

const createServers = require('create-servers');

createServers({
  https: {
    root: '/cert/path',
    cert: [['cert1.crt', 'intermediate.crt'], 'cert2.crt'],
    key: ['cert1.key', 'cert2.key']
  }
}, err => {
  // ...
})

SNI Support

Server Name Indication, or SNI, lets HTTPS clients announce which hostname they wish to connect to before the server sends its certificate, enabling the use of the same server for multiple hosts. Although SNICallback can be used to support this, you lose the convenient certificate normalization provided by create-servers. The sni config option provides an easier way.

The sni option is an object with each key being a supported hostname and each value being a subset of the HTTPS settings listed above. HTTPS settings defined at the top level are used as defaults for the hostname-specific settings.

const createServers = require('create-servers');

createServers(
  {
    https: {
      port: 443,
      sni: {
        'example1.com': {
          key: '/certs/private/example1.com.key',
          cert: '/certs/public/example1.com.crt'
        },
        'example2.com': {
          key: '/certs/private/example2.com.key',
          cert: '/certs/public/example2.com.crt'
        }
      }
    },
    handler: function (req, res) {
      res.end('Hello');
    }
  },
  function (errs) {
    if (errs) {
      return console.log(errs.https);
    }

    console.log('Listening on 443');
  }
);

Use * in the hostname for wildcard certs. Example: *.example.com. The following settings are supported in the host-specific configuration:

• key
• cert
• ca
• ciphers
• honorCipherOrder
• Anything else supported by tls.createSecureContext

NOTE on Security

Inspired by iojs and a well written article, we have defaulted our ciphers to support "perfect-forward-security" as well as removing insecure cipher suites from being a possible choice. With this in mind, be aware that we will no longer support ie6 on windows XP by default.

Examples

http

var createServers = require('create-servers');

var servers = createServers(
  {
    http: 80,
    handler: function (req, res) {
      res.end('http only');
    }
  },
  function (errs) {
    if (errs) {
      return console.log(errs.http);
    }

    console.log('Listening on 80');
  }
);

https

var servers = createServers(
  {
    https: {
      port: 443,
      root: '/path/to/ssl/files',
      key: 'your-key.pem',
      cert: 'your-cert.pem',
      ca: 'your-ca.pem' // Can be an Array of CAs
    },
    handler: function (req, res) {
      res.end('https only');
    }
  },
  function (errs) {
    if (errs) {
      return console.log(errs.https);
    }

    console.log('Listening on 443');
  }
);

http && https

var servers = createServers(
  {
    http: 80,
    https: {
      port: 443,
      root: '/path/to/ssl/files',
      key: 'your-key.pem',
      cert: 'your-cert.pem',
      ca: 'your-ca.pem' // Can be an Array of CAs
    },
    handler: function (req, res) {
      res.end('http AND https');
    }
  },
  function (errs, servers) {
    if (errs) {
      return Object.keys(errs).forEach(function (key) {
        console.log('Error ' + key + ': ' + errs[key]);
        if (servers[key]) {
          servers[key].close();
        }
      });
    }

    console.log('Listening on 80 and 443');
  }
);

http && https (different handlers)

var servers = createServers(
  {
    http: {
      port: 80,
      handler: function (req, res) {
        res.end('http');
      }
    },
    https: {
      port: 443,
      root: '/path/to/ssl/files',
      key: 'your-key.pem',
      cert: 'your-cert.pem',
      ca: 'your-ca.pem', // Can be an Array of CAs
      handler: function (req, res) {
        res.end('https');
      }
    }
  },
  function (errs, servers) {
    if (errs) {
      return Object.keys(errs).forEach(function (key) {
        console.log('Error ' + key + ': ' + errs[key]);
        if (servers[key]) {
          servers[key].close();
        }
      });
    }

    console.log('Listening on 80 and 443');
  }
);

Author: Charlie Robbins

License: MIT