How to run multiple Node.js sites (apps/servers) with separate SSL cert's, on a single IP address?

Question

The desired scenario is as the title suggests: Multiple Node.js servers/apps/websites, on separate domains, each with own SSL certificate, on a single server with a single IP address. So far I have tried:

• A proxy catching all incoming requests and forwarding them to respective apps/servers, on separate, non-443 ports: Does not work, since the proxy server can only run on a single SSL certificate, which will throw an error for all but one of the domains.

• Apps running on different ports and DNS pointing at these ports: Does not work, since an HTTPS connection, will always go to port 443. The SRV DNS record can't change this, for ports 443 and 80.

• Using a single SSL cert issued for an IP address: Is somehow possible, but after doing some research on this, it is not such a good idea.

• Servers responding to specific hostnames: httpsServer.listen(443,'domain.name') throws Error: listen EADDRNOTAVAIL 123.456.789.000:443. This is where I expected the server to ignore all requests but those where hostname is the domain.name. But still, you can't run multiple servers on a single port.

So back to square one: what I need is a proxy, which establishes a connection with an SSL certificate for the specific requested hostname, and forwards the request to an app/server running on a unique port. How? EDIT: Using Nginx, or other proxy/firewall software is certainly an option, but at this point, I am trying to find out a Node.js-only solution.

Answer 1

You can use redbird, a Node.js reverse proxy. Your config will look something like this

var proxy = require('redbird')({port: 80});

proxy.register("example1.com", "http://127.0.0.1:8001", {
  ssl: {
    letsencrypt: {
      email: '[email protected]', // Domain owner/admin email
      production: true, // WARNING: Only use this flag when the proxy is verified to work correctly to avoid being banned!
    }
  }
});

proxy.register("example2.com", "http://127.0.0.1:8002", {
  ssl: {
    letsencrypt: {
      email: '[email protected]', // Domain owner/admin email
      production: true, // WARNING: Only use this flag when the proxy is verified to work correctly to avoid being banned!
    }
  }
});