I have a situation where my express instance is using an unencrypted pfx file that contains my certificate and an encrypted private key. Surprisingly, when I load the pfx in express, it works without needing to provide any password. This has left me wondering how node.js is able to access the private key without it being decrypted. Isn't an unencrypted private key necessary for HTTPS to function properly?
Here is the snippet of the express code:
var httpsOptions = {
'pfx': fs.readfileSync('./cert.pfx'),
'passphrase': ''
};
https.createServer(httpsOptions, expressApp).listen(443, 'example.com');
The information from my .pfx file using openSSL appears as follows:
openssl pkcs12 -in cert.pfx -info
MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: XXXXXXXXXXXX, Iteration 2048
Certificate bag
Bag Attributes
localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
subject=/OU=Domain Control Validated/CN=*.example.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com,
Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure
Certificate Authority - G2
-----BEGIN CERTIFICATE-----
XXXXXXXXXXX=
-----END CERTIFICATE-----
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,XXXXXXXXXXX
XXXXXXXXXXXXXXXX==
-----END RSA PRIVATE KEY-----