Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 1
    Certificates contain public keys, among other information. Commented Oct 30, 2019 at 21:49
  • Thank you. So the certificate contains the public key, and the server.key contains the private key? I've appended the key generation code above in the OP. Commented Oct 30, 2019 at 21:54
  • 1
    The private key is never transmitted by the server, only the public, thus it's called private in the first place. Commented Oct 30, 2019 at 21:58
  • Thank you. I realize that. But I would assume that the location of the private key needs to be made known to the server, and I didn't any reference in the code to the private key (unless as @Ghedipunk may be suggesting server.key is the private key, and the public key is contained in server.crt). Alternatively, if that's not the case, how would the server know where to fetch its private key? (which is really my original question) Commented Oct 30, 2019 at 22:15
  • 1
    I looked up the options parameter for the https.createServer() method. That says it accepts any options from tls.createServer(), tls.createSecureContext() and http.createServer(). Digging a bit more, it's tls.createSecureContext() that asks for the key and cert parameters: nodejs.org/api/tls.html#tls_tls_createsecurecontext_options . This will answer your question definitively. Commented Oct 30, 2019 at 22:22