Implementation of mTLS in NodeJS

References

2. TLS Client Authentication
3. nodejs
4. openssl

Step 1 - Generate certifcate autority using openssl

Ext File (v3.ext)

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = mtls-demo.bcc-ca.gov.bd

Generate CA certificate

Here, Common name is BCC

openssl req \
  -new \
  -x509 \
  -nodes \
  -newkey rsa:2048\
  -days 3650 \
  -subj '/CN=bcc' \
  -keyout ca.key \
  -out ca.crt

Generate CA certificate for client

openssl req \
  -new \
  -x509 \
  -nodes \
  -newkey rsa:2048\
  -days 3650 \
  -subj '/CN=bcc-client' \
  -keyout ca-client.key \
  -out ca-client.crt

Generate Server Certificate

Generate Server Key

openssl genrsa \
  -out server.key 2048

Generate CSR

Here common name is localhost

openssl req \
  -new \
  -key server.key \
  -subj '/CN=mtls-demo.bcc-ca.gov.bd' \
  -out server.csr

Generate Signed Certificate

openssl x509 \
  -req \
  -in server.csr \
  -CA ca.crt \
  -CAkey ca.key \
  -CAcreateserial \
  -days 3650 \
  -extfile v3.ext \
  -out server.crt

Generate Client Certificate

Generate Client Key

openssl genrsa \
  -out client.key 2048

Generate CSR

Here common name is client's name

openssl req \
  -new \
  -key client.key \
  -subj '/CN=torsho' \
  -out client.csr

Generate Signed Certificate

openssl x509 \
  -req \
  -in client.csr \
  -CA ca-client.crt \
  -CAkey ca-client.key \
  -CAcreateserial \
  -days 3650 \
  -out client.crt

Then,

1. we can convert crt to p12
2. import ca/client certificate into keystore using keystore

Testing the server

curl \
  --cacert ca.crt \
  --key client.key \
  --cert client.crt \
  https://localhost:3000