How to verify that a connection is actually TLS se

问题:

I have created a TLS server and an appropriate TLS client in Node.js. Obviously they both work with each other, but I would like to verify it.

Basically, I think of something such as inspecting the connection, or manually connecting to the server and inspecting what it sends, or something like that ...

The relevant code of the server is:

var tlsOptions = {
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('server.pem')
};

tls.createServer(tlsOptions, function (tlsConnection) {
  var d = dnode({
    // [...]
  });
  tlsConnection.pipe(d).pipe(tlsConnection);
}).listen(3000);

The appropriate client code is:

var d = dnode();
d.on('remote', function (remote) {
    // [...]
});

var tlsConnection = tls.connect({
    host: '192.168.178.31',
    port: 3000
});
tlsConnection.pipe(d).pipe(tlsConnection);

How could I do that?

回答1:

Wireshark will tell you if the data is TLS encrypted, but it will not tell you if the connection is actually secure against Man-in-the-Middle attacks. For this, you need to test if your client refuses to connect to a server that provides a certificate not signed by a trusted CA, a certificate only valid for a different host name, a certificate not valid anymore, a revoked certificate, ...

If your server.pem is not a certificate from a real/trusted CA, and your client doesn't refuse to connect to the server (and you didn't explicitly provide server.pem to the client), then your client is very probably insecure. Given that you are connecting to an IP, not a host name, no trusted CA should have issued a certificate for it, so I assume you use a selfsigned one and are vulnerable. You probably need to specify rejectUnauthorized when connect()ing. (Rant: As this is a pretty common mistake, I think it is extremely irresponsible to make no verification the default.)

回答2:

Basically, I think of something such as inspecting the connection, or manually connecting to the server and inspecting what it sends, or something like that ...

You can use tools such as Wireshark to see the data they are transmitting.