Application / Installation

Install SSL on Node.js.

Terminate TLS in Node.js or use a reverse proxy for your application.

Before you begin: use an issued production certificate and its matching private key. Back up the current configuration. Staging certificates are not publicly trusted.

1Choose where TLS terminates

A reverse proxy such as Nginx is usually easier to operate in production. For direct Node.js TLS, store certificates outside the public directory and give the runtime user read-only access to the key.

2Create an HTTPS server

Pass your application's request handler instead of the minimal handler below. The configured port must be exposed or forwarded appropriately. Do not run Node as root merely to bind port 443.

Create an HTTPS server

import https from 'node:https';
import { readFileSync } from 'node:fs';

const server = https.createServer({
  key: readFileSync('/run/secrets/privkey.pem'),
  cert: readFileSync('/run/secrets/fullchain.pem'),
  minVersion: 'TLSv1.2',
}, (request, response) => {
  response.writeHead(200, { 'Content-Type': 'text/plain' });
  response.end('Secure connection');
});

server.listen(8443, '0.0.0.0');

3Plan certificate reloads

After renewal, restart gracefully or update the secure context with the new matching certificate and key. Never place private keys in source control, container images, logs, or static assets.

Confirm the connection.

Check the installed certificate and chain, then keep an eye on the expiry date.

Open SSL Checker