node socket.js doesn't work with SSL when key has a passphrase

[uLow]

Hi there!
I'm trying to run node socket.js as daemon with SSL certificate, but it's asking for certificate PEM password, so i can't start it like node socket.js & or using supervisord.

Could you advice how to achieve that?

[REBELinBLUE]

You'd need to remove the password from the key https://futurestud.io/tutorials/how-to-remove-pem-password-from-ssl-certificate

[uLow]

Of course it's not a solution. Since my company is under PCI DSS licence, we can't remove password from the key. Is there another workaround?

[REBELinBLUE]

Edit

https://github.com/REBELinBLUE/deployer/blob/master/socket.js#L20

and add passphrase to the object, i.e so you have

    var ssl_conf = {
        key:  (process.env.SOCKET_SSL_KEY_FILE  ? fs.readFileSync(process.env.SOCKET_SSL_KEY_FILE)  : null),
        cert: (process.env.SOCKET_SSL_CERT_FILE ? fs.readFileSync(process.env.SOCKET_SSL_CERT_FILE) : null),
        ca:   (process.env.SOCKET_SSL_CA_FILE   ? fs.readFileSync(process.env.SOCKET_SSL_CA_FILE)   : null),
       passphrase: 'mypassword'
    };

https://nodejs.org/api/tls.html#tls_tls_createserver_options_secureconnectionlistener

That seems rather ridiculous to me personally as that means the password is being stored on disk in plaintext 😧

I'll see about add a SOCKET_SSL_KEY_PASSPHRASE option