watson / https-pem Goto Github PK

Due to an openssl upgrade in Node 10, using this inside of Node.js tls.Server results in the following:

Error: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
    at Object.createSecureContext (_tls_common.js:131:17)
    at Server.setSecureContext (_tls_wrap.js:1152:27)
    at Server (_tls_wrap.js:1029:8)
    at new Server (https.js:65:14)
    at Object.createServer (https.js:89:10)

_tls_common.js:135
c.context.setCert(cert);
^

Error: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small

any idea?

Shipping the private key is highly insecure, as an attacker can exploit it from the public internet (it happened for webpack).

How about we generate the key on install? or we can store it in the .config folder on the first install and then reuse it.