SSL using self-signed cert over Node.js

Question

Some reference material for SSL using Node.js: http://nodejs.org/api/https.html

I need to build a proof of concept secure SSL connection between a Node.js server and a browser.

The client needs to encrypt the data it sends and then the server needs to store that data in the database encrypted.

I guess this means I need client side JS to encrypt the data? How would I go about doing this if so (client OR server)? Thanks!

Maarten Bodewes · Accepted Answer · 2014-09-25 21:36:44Z

1

For the client you have no alternative than to use the build in browser TLS/SSL. You can implement JavaScript SSL if it would come to that, but you cannot distribute a trusted database of certificates to the browser.

Once a secure and trusted path has been created from client to server, you can additionally encrypt data using a public (RSA or EC) key send to the client and hybrid cryptography. That way you can use application level cryptography on top of transport security - although the application level crypto will always be dependent on the security and trust that TLS/SSL provides.

Whatever scheme you will be using, you must understand cryptography and the issues with JavaScript cryptography in the browser if you go this route. Just coding stuff won't give you any security, only a false sense of security.

answered Sep 25, 2014 at 21:36

Maarten Bodewes

94.6k15 gold badges169 silver badges289 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Wes Over a year ago

I guess the thing to do then is encrypt it on the server just prior to storing it?

Maarten Bodewes Over a year ago

That would be a sensible strategy, yes. In the end, the security will have to rely on the server anyway.

Collectives™ on Stack Overflow

SSL using self-signed cert over Node.js

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related