如何使用已有证书在Node.js部署HTTPS？如何生成CSR与私钥？

Hey there! Let's sort out this HTTPS certificate configuration issue for you step by step.

First, let's clarify a few key concepts to avoid confusion:

• Private Key (.key file): This is a paired file generated automatically when you create a Certificate Signing Request (CSR). It's the core of HTTPS encryption and must match the CSR you submitted to your certificate provider.
• CSR (.csr file): This is just the "application file" you sent to the provider to request the certificate. Once you have the official .crt certificate, you don't need the CSR anymore—it's not required in your code configuration at all!

Your main problem is missing the private key file, since your current options only includes the cert field, but an HTTPS server requires both cert and key to work properly.

Solutions for Two Scenarios #

Scenario 1: You generated a CSR before but lost the private key #

If you submitted your own CSR to the provider, the private key should be on the machine where you created the CSR. If you can't find it, the safest approach is to generate a new set of CSR + private key, then submit the new CSR to your provider to reissue the certificate—private keys can't be recovered once lost, and using the old certificate without the matching key poses security risks.

Use this OpenSSL command (supported on almost all systems) to generate a new CSR and private key:

openssl req -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

When you run this, you'll be asked to fill in some details (like domain name, organization name, etc.). Make sure the Common Name matches your certificate's domain exactly. After execution, you'll get two files:

• yourdomain.key: This is your private key—keep it safe and don't share it with anyone.
• yourdomain.csr: Send this file to your certificate provider to get a reissued .crt certificate.

Scenario 2: You had the provider generate the certificate for you (no custom CSR) #

Some providers offer one-click certificate generation services. In this case, they should provide you with both the .crt and .key files. If you only received the .crt, contact your provider immediately to request the matching private key—this is part of the service you paid for.

Correct Code Configuration #

Once you have the private key, update your code to include the key field in the options:

var options = { 
  cert: fs.readFileSync('./https/8546332154a5224.crt'),
  key: fs.readFileSync('./https/yourdomain.key') // Replace with your private key file path
}; 
var app = express(); 
var server = https.createServer(options, app); 
var expressWs = expressWs(app, server);

Extra Tips #

• Ensure your private key file has proper permissions (e.g., on Linux, set it to chmod 600 yourdomain.key) to prevent unauthorized access.
• If your certificate is a chained certificate (some providers separate the main certificate and intermediate certificates), you may need to merge the main and intermediate certificates into one .crt file, or add a ca field in the options pointing to the intermediate certificate file.

内容的提问来源于stack exchange，提问作者Alex Parra