9

I am trying to use HTTPS on my Node.js app, just as it is already enabled for anything else. I have the keys and certificates already installed, but I get a Error: EACCES, permission denied when I tried to point to them on the app.

Both the key and the certificate are in subfolder of /etc/pki/tls, and I attempted pointing to them like this:

var privateKey = fs.readFileSync('/etc/pki/tls/private/serverKey.key').toString(),
    certificate = fs.readFileSync('/etc/pki/tls/certs/2_mikewarren.me.crt').toString();

var options = {
    key: privateKey,
    cert: certificate
}

Do I need to adjust the permissions of the keys and certificates (via chown)? If so, is it safe to do?

4
  • Why not just move the files to the directory where your node.js code is? You know the node.js process has the rights to read that directory and you know that directory is protected from outside access, right?
    – jfriend00
    Commented Jul 24, 2016 at 22:09
  • @jfriend00 copy them? Commented Jul 24, 2016 at 22:25
  • They're files in your OS. You can just move those files to the appropriate directory. If you're using them for your https server, you aren't presumably using them for other things. Or put them in better shared location that all things who need access can get access.
    – jfriend00
    Commented Jul 24, 2016 at 22:29
  • I am using them for phpMyAdmin Commented Jul 25, 2016 at 1:00

3 Answers 3

9

I got my code access.

What I did

  1. created new user group called certAccess
  2. added myself to certAccess by saying sudo useradd ec2-user -G certAccess
  3. added root user (who was the only user with access to those files) to certAccess
  4. changed the owner of the private key: sudo chown ec2-user.certAccess /etc/pki/tls/private/serverKey.key

Testing...

To test, I simply print options to the console, right after using it. Indeed, I saw the contents of private key and certificate (try it yourself). I also restart httpd server, and requested static files. I saw them, protected with TLS, without fault.

1

The problem is that these certificates are only readable by root (and maybe an other user).

You could use chmod to give read access to all users, but that means… that all users would have access to it. So, bad idea.

An other solution would be to either chown these files to the user running node.js, but if there is already a user with an application using these, it will break it. In that case, create a new group that owns the file, give read permissions to that group, and add the users that should access the files in that group.

3
  • How to do this? For example, how to create groups? Commented Jul 24, 2016 at 22:00
  • I created the group to access the certificate (in the server's specified directory). Now how do I change permissions for the group to access it? I want to be able to have SSL/TLS whether my node.js code is running or not Commented Aug 5, 2016 at 3:14
  • with chown and chmod Commented Aug 5, 2016 at 7:59
0

I had the same problem but my solution is slightly different than MikeWarren's

  1. Create new user group called certAccess
  • sudo groupadd certAccess
  1. Add existing users to certAccess group
  • sudo usermod -a -G certAccess YOUR_USER
  1. Inorder to activate user groups logout and login again

  2. Change group ownership of cert files or if you have more than one certificate change folder ownership recursively.

  • sudo chown -R root:certAccess /etc/letsencrypt/live/
  • sudo chown -R root:certAccess /etc/letsencrypt/archive/
  1. Default cert files have mod 744, Node.js readFileSync() can't execute cert files so add execute permission to group by changing mod to 754.
  • sudo chmod -R 754 /etc/letsencrypt/live/
  • sudo chmod -R 754 /etc/letsencrypt/archive/

Done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.