[root@localhost ~]#(umask 066;openssl genrsa -out /etc/pki/CA/private/cakey.pem  2048 )
Generating RSA private key, 2048 bit long modulus
.............................................+++
.........................+++
e is 65537 (0x10001)

[root@localhost ~]#openssl req -new -x509 -key  /etc/pki/CA/private/cakey.pem -days 7300 -out  /etc/pki/CA/cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ''.'', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shandong
Locality Name (eg, city) [Default City]:qingdao
Organization Name (eg, company) [Default Company Ltd]:pojun.tech
Organizational Unit Name (eg, section) []:Opt
Common Name (eg, your name or your server''s hostname) []:ca.pojun.tech
Email Address []:

[root@localhost ~]#openssl x509 -in /etc/pki/CA/cacert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 17076170100312404196 (0xecfabe3b994470e4)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=shandong, L=qingdao, O=pojun.tech, OU=Opt, CN=ca.pojun.tech
        Validity
            Not Before: Sep 29 03:40:10 2017 GMT
            Not After : Sep 24 03:40:10 2037 GMT
        Subject: C=CN, ST=shandong, L=qingdao, O=pojun.tech, OU=Opt, CN=ca.pojun.tech    
    *******************省略了公钥和签名信息*************************

touch /etc/pki/CA/index.txt

 echo 01 > /etc/pki/CA/serial

[root@CentOS6 ~]$rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf  # 配置文件
/usr/lib64/httpd/modules/mod_ssl.so  # Apache 动态模块
/var/cache/mod_ssl
/var/cache/mod_ssl/scache.dir
/var/cache/mod_ssl/scache.pag
/var/cache/mod_ssl/scache.sem

# 首先创建一个目录用来管理生成的私钥和证书请求文件，可根据自己的实际情况而定
[root@centos6 ~]$ mkdir /etc/httpd/conf.d/ssl

# 生成自己的私钥文件
[root@centos6 ~]$(umask 066; openssl genrsa -out /etc/httpd/conf.d/ssl/httpd.key 1024)
Generating RSA private key, 1024 bit long modulus
.++++++
...++++++
e is 65537 (0x10001)

# 生成自己的证书申请文件，以 .csr 结尾的文件。
[root@centos6 ssl]$openssl req -new -key /etc/httpd/conf.d/ssl/httpd.key -out /etc/httpd/conf.d/ssl/httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ''.'', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shandong
Locality Name (eg, city) [Default City]:yantai
Organization Name (eg, company) [Default Company Ltd]:pojun.tech
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server''s hostname) []:*.a.com
Email Address []:

Please enter the following ''extra'' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@centos6 ssl]$scp /etc/httpd/conf.d/ssl/httpd.csr  172.18.2.77:/etc/pki/CA/
root@172.18.2.77''s password: 
httpd.csr                                        100%  647     0.6KB/s   00:00

# 根据主机A提交的证书申请内容，生成证书
[root@localhost ~]#openssl ca -in /etc/pki/CA/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365
*****************中间省略了输出信息***********************

#  前面我们说过，证书文件都存放在/etc/httpd/conf.d/ssl/目录下
[root@localhost ~]#scp  /etc/pki/CA/certs/httpd.crt  172.18.2.66:/etc/httpd/conf.d/ssl/
The authenticity of host ''172.18.2.66 (172.18.2.66)'' can''t be established.
RSA key fingerprint is 00:c0:e5:a6:39:e9:a7:bb:1b:f4:ab:0d:75:9b:38:b0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ''172.18.2.66'' (RSA) to the list of known hosts.
root@172.18.2.66''s password: 
httpd.crt                                         100% 3714     3.6KB/s   00:00

[root@localhost ~]#scp  /etc/pki/CA/cacert.pem   172.18.2.66:/etc/httpd/conf.d/ssl/
root@172.18.2.66''s password: 
cacert.pem                                   100% 1334     1.3KB/s   00:00

解决方法

我目前正在运行Nginx背后的一系列Node.js表达应用程序.但是,虽然我的应用程序运行正常,但我在某些情况下遇到间歇性的502 Bad Gateway错误.

主实例是用户尝试登录的位置.通常第一次登录尝试将返回502错误(并且此错误将是即时的而不是在延迟之后发生),而此后立即的第二次尝试将处理正常,而请求标头中没有变化.

我已经检查了Nginx和express的日志,看起来在第一个例子中,尽管细节相同,但第一次尝试返回500错误(如在登录尝试错误的情况下计划的那样).然后,这会在Nginx中触发502错误.

Nginx错误日志：

2013/10/21 19:32:57 [error] 8178#0: *32101 upstream prematurely closed connection while reading response header from upstream, client: 82.40.77.228, server: instok.net, request: "POST /login HTTP/1.1", upstream: "https://127.0.0.1:5001/login", host: "instok.net", referrer: "https://instok.net/"

Nginx访问日志：

- [21/Oct/2013:19:32:57 +0000] "POST /login HTTP/1.1" 502 172 "https://instok.net/" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0" "-"82.40.77.228 - 
- [21/Oct/2013:19:32:59 +0000] "POST /login HTTP/1.1" 200 5 "https://instok.net/" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0" "-"82.40.77.228 - 

快速访问日志：

- [Mon, 21 Oct 2013 19:32:57 GMT] \"POST /login HTTP/1.0\" 500 69 \"https://instok.net/\" 
- [Mon, 21 Oct 2013 19:32:59 GMT] \"POST /login HTTP/1.0\" 200 - \"https://instok.net/\"

服务器端身份验证

function authenticate(name, pass, fn) {

  User.findOne({_id: name}, function(err, user) {
   if (!user) {  return fn(new Error("Cannot find user"))}; 

   bcrypt.compare(pass, user.hash, function(err, res){
     if (err || !res) { return fn(err) }

     else {
        return fn(null, user);
        }
    })
  })
}

exports.logIn = function(req, res){
 authenticate(req.body.username, req.body.password, function(err, user){
  if (user){
      req.session.regenerate(function(){
        req.session.user = user;
        res.status(200).send();
      })
  }
  else {
    res.status(500).send({message: "Error with username or password - please try again"})
  }

 });
}

我的Nginx.conf文件的相关部分是https://gist.github.com/grabbeh/6721046,我还使用同一个文件运行其他几个node.js应用程序.

在客户端,我使用Angular.js和$http.post将登录详细信息发送到服务器,条件处理取决于是否从服务器发回200或500错误.

我还使用routeChangeError事件从服务器重定向500错误,以重定向到登录页面,在登录页面中尝试在登录之外访问路由.但是,我不认为客户端处理是相关的,因为在任何客户端处理之前返回错误.

很可能有更好的处理身份验证的方法,这当然可以解决上述问题,但是目前我想要了解间歇性502错误的底部.

该错误确实似乎来自Express返回500,当它应该返回200但我无法识别问题,尽管玩弄代码.我们将非常感激地收到任何意见.该应用程序本身在https://instok.net上运行,可以查看所有客户端代码.

出于兴趣,502和有效请求的详细信息如下：

编辑

我缺少的一点是我使用https://github.com/nodejitsu/forever来保持应用程序在崩溃时运行.在检查了Forever日志后,很明显问题是连接到MongoDB数据库失败导致应用程序崩溃.此错误未在应用程序中捕获,因此,据我所知,Express日志中未引用该错误.现在已经解决了这个问题,而且我已经切换到另一个MongoDB实例,我希望能解决问题.

解决方法:

我相信我发现了一个问题,即由于mongoose无法连接到MongoDB实例而导致未被捕获的错误.我现在已经处理了错误并将数据库切换到另一个实例.触摸木材,我目前没有任何进一步的问题.