How to run a secure shieldsio server locally

[SilverTux]

I don't know if it is even possible to do this easily and I haven't found any documentation about how one can run shieldsio in a secure (HTTPS) way locally.

I've followed this description and I've successfully deployed a working server, but it listens only on HTTP.

I thought that maybe I need only some small reconfiguration and it will work securely, so what I did is to modify config/production.yaml

public:
  bind:
    address: '0.0.0.0'
    port: 5443

  ssl:
    isSecure: true
    key: 'https.key'
    cert: 'https.crt'

The steps what I used to generate the secrets are (self-signed certificate for the sake of ease):

openssl genrsa -out https.key
openssl req -new -key https.key -out csr.pem
openssl x509 -req -days 9999 -in csr.pem -signkey https.key -out https.crt
rm csr.pem

After rebuilding the docker image and deploying it again the server starts to listen but after the first HTTP GET I'm getting an error:

internal/buffer.js:958
    super(bufferOrLength, byteOffset, length);
    ^

RangeError: Invalid typed array length: -4095
    at new Uint8Array (<anonymous>)
    at new FastBuffer (internal/buffer.js:958:5)
    at Handle.onStreamRead [as onread] (internal/stream_base_commons.js:187:19)
    at Stream.<anonymous> (/usr/src/app/node_modules/spdy/node_modules/handle-thing/lib/handle.js:120:12)
    at Stream.emit (events.js:412:35)
    at Stream.emit (domain.js:475:12)
    at endReadableNT (/usr/src/app/node_modules/readable-stream/lib/_stream_readable.js:1010:12)
    at processTicksAndRejections (internal/process/task_queues.js:82:21)

and the client side curl command returns with:

curl -k https://127.0.0.1:5443
curl: (52) Empty reply from server

Does anyone tried to achieve the same thing and had success with it? Maybe I'm missing something obvious, I'm not too familiar with nodejs. I appreciate any help.

Thanks, SilverTux

[calebcartwright]

the ssl block needs to go under the public key, and based on the indentation it looks like that might not be the case given how pedantic yaml is about whitespace.

That being said, you might find it easier to just stick something like nginx or haproxy in front of your badge server and let them handle ssl termination

[SilverTux]

Sorry my indentation here is wrong as you written, but in the config it is properly indented, I mean there is no yaml parse error in the output.

[SilverTux]

I've updated the question with the right indentation.
Thank you for the idea, I'll look into a solution like nginx or haproxy.
I was wondering about this idea and a question was popped up in my head, does the production shields server use a solution like you mentioned and the ssl part of the config is only a beta feature?

[paulmelnikow]

We used to use self-signed certificates on the origin servers, but stopped when we migrated to Heroku, which handles SSL in the router instead of in the application.

[SilverTux]

Thank You for the answers, I've managed to solve the HTTPS termination problem using nginx.
In details: https://stackoverflow.com/questions/69533210/how-to-run-a-secure-shieldsio-server-locally/