Tech Insights: Personal Tech Blog

1
2
3
4
5

sudo certbot certonly --standalone -d api.yourdomain.com

# Files:
# /etc/letsencrypt/live/api.yourdomain.com/fullchain.pem  → cert + chain
# /etc/letsencrypt/live/api.yourdomain.com/privkey.pem    → private key

1
2

#!/bin/bash
pm2 reload your-app-name   # or nginx -s reload, etc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// server.js
import https from 'node:https';
import fs from 'node:fs';

const options = {
  key: fs.readFileSync('/etc/letsencrypt/live/api.yourdomain.com/privkey.pem'),
  cert: fs.readFileSync('/etc/letsencrypt/live/api.yourdomain.com/fullchain.pem'),

  // 2025 best practice
  minVersion: 'TLSv1.2',
  honorCipherOrder: true,
  ciphers: [
    'TLS_AES_256_GCM_SHA384',
    'TLS_CHACHA20_POLY1305_SHA256',
    'TLS_AES_128_GCM_SHA256'
  ].join(':')
};

https.createServer(options, (req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello Secure World!\n');
}).listen(443, () => console.log('HTTPS on :443'));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

// src/server.ts
import express, { Request, Response, NextFunction } from 'express';
import https from 'node:https';
import fs from 'node:fs';
import helmet from 'helmet';
import { hsts } from 'hsts';

const app = express();

// Security headers
app.use(helmet({
  contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// HSTS – 2 years + preload
app.use(hsts({
  maxAge: 63072000,
  includeSubDomains: true,
  preload: true
}));

// Redirect HTTP → HTTPS (only in production & behind proxy)
app.use((req: Request, res: Response, next: NextFunction) => {
  if (process.env.NODE_ENV === 'production' && req.headers['x-forwarded-proto'] !== 'https') {
    return res.redirect(301, `https://${req.headers.host}${req.url}`);
  }
  next();
});

app.get('/', (_req, res) => {
  res.send('Encrypted with TLS 1.3');
});

// Production HTTPS server
if (process.env.NODE_ENV === 'production') {
  const httpsOptions = {
    key: fs.readFileSync(process.env.SSL_KEY_PATH!),
    cert: fs.readFileSync(process.env.SSL_CERT_PATH!),
    minVersion: 'TLSv1.2',
    ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
    honorCipherOrder: true,
  };

  https.createServer(httpsOptions, app).listen(443, () => {
    console.log('HTTPS listening on :443');
  });
} else {
  app.listen(4000, () => console.log('HTTP (dev) on :4000'));
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Generate trusted local CA + cert (one-time)
openssl req -x509 -nodes -new -sha256 -days 1024 -newkey rsa:4096 \
  -keyout rootCA.key -out rootCA.pem -subj "/C=US/CN=LocalDev-CA"

openssl req -new -nodes -newkey rsa:2048 \
  -keyout localhost.key -out localhost.csr \
  -subj "/C=US/CN=localhost"

openssl x509 -req -in localhost.csr -CA rootCA.pem -CAkey rootCA.key \
  -CAcreateserial -extfile <(echo "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1") \
  -out localhost.pem -days 365 -sha256

1
2
3
4
5
6

app.set('trust proxy', true); // Critical!

app.use((req, _res, next) => {
  // req.protocol, req.secure, req.hostname now correct
  next();
});