Add support for using SSL client certificates when making target HTTP requests.

[kevinswiber]

This should be a fairly straightforward change. We'll have to add configuration options for key and cert files per host. Then we can update the HTTP agent to use these based on the hostname for the backend request.

[kevinswiber]

An early Pull Request is ready for testing here: #11.

[kevinswiber]

These changes have been pushed to edgemicro@2.1.0-beta. @srinandan has been testing it out and will report issues here.

To install: npm install -g edgemicro@2.1.0-beta.

[zcmack]

installed this and am working with it now. attempting to hit a node service running on another machine on the network, getting the following error response. {"message":"write EPROTO","code":"EPROTO","errno":"EPROTO","syscall":"write"}.

I can send you my configuration file if you'd like but I'm wondering if this has to do with using a self signed certificate or not?

[srinandan]

I think it might be something else. Self-signed certs should work. You should set the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0 if you're using self-signed certs.

Please do send us the configuration file.

[kevinswiber]

@zcmack It definitely seems TLS related. I just had a thrilling read through this very long thread: nodejs/node#3692

[asnowfix]

Usually I get this (misleading) error from EMG when it unsuccessfully tries to directly reach an SSL site while it should use a proxy...

[zcmack]

so i created a different express service on my local machine and secured via https. loaded in my certs and am now receiving {"message":"self signed certificate","code":"DEPTH_ZERO_SELF_SIGNED_CERT"}

i included rejectUnauthorized: "false" in my conf file, but I'm still having issues.

[srinandan]

Please set environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0

[zcmack]

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; is the first line in my
node service.

On Wed, Sep 21, 2016 at 4:52 PM, Srinandan Sridhar <notifications@github.com

wrote:

Please set environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#9 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AGFBdi7p46ejUHktcmGnwOa5Nx_4bxSUks5qsacpgaJpZM4J1_BE
.

[srinandan]

Try setting it as an environment variable (outside of node.js).

[zcmack]

tried it as an environmental var with no luck. i added rejectUnauthorized=false to my config file and my service and specified the ca in both places as well. My error message changed to

{"message":"self signed certificate in certificate chain","code":"SELF_SIGNED_CERT_IN_CHAIN"}

Any other ideas?

[zcmack]

ok so i was able to get this working by setting the environment variable on the EMG rather than the server, my bad. I am curious how we can configure this to use bi-directional SSL. How can I configure a truststore on the EMG?

[kevinswiber]

@zcmack You can point to a file for the CA.

targets:
  - host: 'example.com'
    ssl:
      client:
        key: '/location/of/key'
        cert: '/location/of/cert'
        ca: '/location/of/ca'