Run a Node.js HTTPS server

Time to put the lab certificate to work. An HTTPS server combines an application listener with a certificate chain and matching private key. Node.js ships this in the standard library, so we need no dependencies at all.

Create server.mjs in the directory that holds app.key and app.crt:

import https from 'node:https'
import fs from 'node:fs'

https.createServer({
  key: fs.readFileSync('app.key'),
  cert: fs.readFileSync('app.crt'),
}, (request, response) => {
  response.end('secure lab\n')
}).listen(8443, '127.0.0.1')

The options object is where TLS happens: key is the server’s private key, cert is the certificate we issued. The second argument to listen binds the server to 127.0.0.1 only. Keep the first lab on loopback — nothing outside your machine can reach it, which is exactly what you want while practicing.

Run it:

node server.mjs

No output means it started. Confirm port 8443 is bound only to loopback:

lsof -iTCP:8443 -sTCP:LISTEN
# COMMAND   PID   USER   TYPE  NAME
# node    41235 flavio   IPv4  localhost:8443 (LISTEN)

The localhost:8443 in the NAME column confirms the loopback bind. If you saw *:8443 instead, the server would be listening on every interface.

Now probe it from a second terminal:

curl https://127.0.0.1:8443/
# curl: (60) SSL certificate problem: unable to get local issuer certificate

That error is correct behavior. curl does not trust your lab CA, so verification fails. The next lessons fix this the right way — by giving curl the hostname and the root — not by turning verification off.

One failure mode worth knowing: if key and cert do not belong together, server creation stops immediately with a key-values-mismatch error from OpenSSL. Node refuses to start rather than serve a broken identity. When you see it, you loaded a key from one generation and a certificate from another; re-check which files you copied.

Restrict private-key permissions with chmod 600 app.key and do not expose the practice service beyond your own computer.