//為CA生成私鑰
 openssl genrsa -out ca-key.pem -des 1024
//通過CA私鑰生成CSR
 openssl req -new -key ca-key.pem -out ca-csr.pem
//通過CSR文件和私鑰生成CA證書
 openssl x509 -req -in ca-csr.pem -signkey ca-key.pem -out ca-cert.pem

//（1）為服務(wù)器生成私鑰
 openssl genrsa -out server-key.pem 1024
//（2）利用服務(wù)器私鑰文件服務(wù)器生成CSR
 openssl req -new -key server-key.pem -config openssl.cnf -out server-csr.pem

[req]  
    distinguished_name = req_distinguished_name  
    req_extensions = v3_req  
    [req_distinguished_name]  
    countryName = Country Name (2 letter code)  
    countryName_default = CN  
    stateOrProvinceName = State or Province Name (full name)  
    stateOrProvinceName_default = BeiJing  
    localityName = Locality Name (eg, city)  
    localityName_default = YaYunCun  
    organizationalUnitName  = Organizational Unit Name (eg, section)  
    organizationalUnitName_default  = Domain Control Validated  
    commonName = Internet Widgits Ltd  
    commonName_max  = 64  
    [ v3_req ]  
    # Extensions to add to a certificate request  
    basicConstraints = CA:FALSE  
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment  
    subjectAltName = @alt_names  
    [alt_names]  
	#注意這個(gè)IP.1的設(shè)置，IP地址需要和你的服務(wù)器的監(jiān)聽地址一樣
    IP.1 = 127.0.0.1

//(3)通過服務(wù)器私鑰文件和CSR文件生成服務(wù)器證書
 openssl x509 -req -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -in server-csr.pem -out server-cert.pem -extensions v3_req -extfile openssl.cnf

//(1)生成客戶端私鑰
 openssl genrsa -out client-key.pem
//(2)利用私鑰生成CSR
 openssl req -new -key client-key.pem -out client-csr.pem
//(3)生成客戶端證書
 openssl x509 -req -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -in client-csr.pem -out client-cert.pem

//(1)打包服務(wù)器端證書
 openssl pkcs12 -export -in server-cert.pem -inkey server-key.pem -certfile ca-cert.pem -out server.pfx
//(2)打包客戶端證書
 openssl pkcs12 -export -in client-cert.pem -inkey client-key.pem -certfile ca-cert.pem -out client.pfx

var https = require('https');
var fs = require('fs');
var options = {
	pfx:fs.readFileSync('./keys/server.pfx','utf-8'),
	passphrase:'your password'
};
https.createServer(options,function(req,res){
	res.writeHead(200);
	res.end('hello world\n');
}).listen(3000,'127.0.0.1');

var https = require('https');
var fs = require('fs');
var options = {
	hostname:'127.0.0.1',
	port:3000,
	path:'/',
	method:'GET',
	pfx:fs.readFileSync('./keys/server.pfx','utf-8'),
	passphrase:'your password',
	agent:false
};
options.agent = new https.Agent(options);
var req = https.request(options,function(res){
console.log("statusCode: ", res.statusCode);
  console.log("headers: ", res.headers);
	res.setEncoding('utf-8');
	res.on('data',function(d){
		console.log(d);
	})
});
req.end();
req.on('error',function(e){
	console.log(e);
})