Node.js https pem error: routines:PEM_read_bio:no start line

Question

I am messing with login form right now with node.js, I tried creating a pem key and csr using

openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem

However I been getting errors for running node server.js

Here is my server.js

var http = require('http'),
    express = require('express'),
UserServer = require('./lib/user-server');

var https = require('https');
var fs = require('fs');

var options = {
  key: fs.readFileSync('./key.pem', 'utf8'),
  cert: fs.readFileSync('./csr.pem', 'utf8')
};

var app = express();

app.configure(function(){
  app.use(express.bodyParser());
  app.use(app.router);
  app.use(express.static(__dirname + '/public'));
});

var httpserver = http.createServer(app).listen('3004', '127.0.0.1');
var https_server = https.createServer(options, app).listen('3005', '127.0.0.1');
UserServer.listen(https_server);

Here is the error

crypto.js:104
  if (options.cert) c.context.setCert(options.cert);
                          ^
Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
    at Object.exports.createCredentials (crypto.js:104:31)
    at Server (tls.js:1107:28)
    at new Server (https.js:35:14)
    at Object.exports.createServer (https.js:54:10)

I tried running

openssl x509 -text -inform DER -in key.pem

It gives

unable to load certificate
140735208206812:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1319:
140735208206812:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=X509

I am not exactly sure what does the error mean as my encryption file is .pem file already, so any help would be much appreciated.

Thanks

score 118 · Answer 1 · edited Sep 16 '19 at 18:12

118

You are probably using the wrong certificate file, what you need to do is generate a self signed certificate which can be done as follows

openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem
openssl x509 -req -days 365 -in csr.pem -signkey key.pem -out server.crt

then use the server.crt

   var options = {
      key: fs.readFileSync('./key.pem', 'utf8'),
      cert: fs.readFileSync('./server.crt', 'utf8')
   };

edited Sep 16 '19 at 18:12

toto_tico

17,977
9
97
116

answered Jun 18 '14 at 10:27

Hassaan

1,561
1
9
15

1

I tried this, but when I reload my services I get an error "EACCES, permission denied" – harryBundles Dec 10 '15 at 18:36
The node process may not have the rights to read the certificates or bind to the port. Try running through sudo if you are on linux. – Hassaan Jan 25 '16 at 11:19
Typically it would be in your app.js file if you are working on express or bare nodejs app. – Hassaan Feb 03 '17 at 13:02
4

Are you sure that `./csr.pem` is the correct file for `key` option? It was giving me the same error, but when I switched key to `./key.pem`, everything worked. Seems like the last edit that have been made to your original answer is wrong. – Michael Radionov May 04 '19 at 14:02
1

(Note that Michael's comment here was heeded and the answer has been edited and is now correct.....for anyone else looking back and forth between comment and answer trying to figure that out.) – temporary_user_name May 25 '20 at 23:26
Thank you for this answer. It helped. You can also use `mkcert(1)`, which is very good. It is available [here](https://github.com/FiloSottile/mkcert/releases) – NYCeyes Sep 04 '22 at 03:48

score 17 · Answer 2 · answered Mar 12 '18 at 12:11

I removed this error by write the following code

Open Terminal

openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem
openssl x509 -req -days 365 -in csr.pem -signkey key.pem -out server.crt

Now use the server.crt and key.pem file

app.js or server.js file

var https = require('https');
var https_options = {
  key: fs.readFileSync('key.pem', 'utf8'),
  cert: fs.readFileSync('server.crt', 'utf8')
};

var server = https.createServer(https_options, app).listen(PORT);
console.log('HTTPS Server listening on %s:%s', HOST, PORT);

It works but the certificate is not trusted. You can view the image in image file.

this is normal. Chrome doesn't recognize self-signed certificates, only certificates from CA that it trusts. You have three different solutions: 1. chrome://flags -> Allow invalid certificates from localhost 2. Add your certificate to your browser so it accepts this new CA 3. Use a third-party service like LetsEncrypt — Ben, Apr 07 '21 at 02:09

Kyle Coots · Answer 3 · 2019-09-17T21:17:10.227

For me the issues was I had the key and cert swapped.

var options = {
   key: fs.readFileSync('/etc/letsencrypt/live/mysite.com/privkey.pem'),
   cert: fs.readFileSync('/etc/letsencrypt/live/mysite.com/fullchain.pem'),
   ca: fs.readFileSync('/etc/letsencrypt/live/mysite.com/chain.pem')
};

EDIT

More Complete Example (Maybe not completely functional)

Server.js

    var fs = require('fs');

    var sessionKey = 'ai_session:';
    var memcachedAuth = require('memcached-auth');

    var clients = {};
    var users = {};

    var options = {
      key: fs.readFileSync('/etc/letsencrypt/live/somesite.com/privkey.pem'),
      cert: fs.readFileSync('/etc/letsencrypt/live/somesite.com/fullchain.pem'),
      ca: fs.readFileSync('/etc/letsencrypt/live/somesite.com/chain.pem')
    };

    var origins = 'https://www.somesite.com:*';
    var https = require('https').createServer(options,function(req,res){

        // Set CORS headers
        res.setHeader('Access-Control-Allow-Origin', origins);
        res.setHeader('Access-Control-Request-Method', '*');
        res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET');
        res.setHeader('Access-Control-Allow-Headers', '*');

    });

    var io = require('socket.io')(https);
    https.listen(3000);

    io.sockets.on('connection', function(socket){

      socket.on('auth', function(data){

          var session_id = sessionKey+data.token;
          memcachedAuth.is_logged_in(session_id).then( (response) => {

          if(response.is_logged_in){

              // user is logged in
              socket.emit('is_logged_in', true);

              messenger.addUser(socket); 

              // dynamic room
              socket.on('room', function(room){
             socket.join(room);
             console.log('joing room '+room);
              });

              socket.on('message', function(data){
              messenger.receive(data.message_data);                 
              });
          }else{
              // Not logged in
              socket.emit('is_logged_in', false);
          }
          }).catch( (error) => {
          console.log(error);
          });

      });


    });


    var messenger = {
        socket: (socket)=>{
          return socket;  
        },
        subscribe: (room)=>{

        },
        unsubscribe: (room)=>{

        },
        send: (data)=>{

        },
        receive: (data)=>{
        console.log(data);
          //connected
          if (clients[data.user_name]){
            console.log('user');
          }    
        },
        addUser: (socket)=>{
        socket.on('add-user', function(data){
            clients[data] = {
              "socket": socket.id
            };
            console.log('Adding User:' + data);
            console.log(clients);
        });          
        },
        private: (socket)=>{
        // Not working yet...
        socket.on('message', function(data){

            console.log("Sending: " + data + " to " + data.user_name);

            if (clients[data.user_name]){
              io.sockets.connected[clients[data.user_name].socket].emit("response", data);
            } else {
              console.log("User does not exist: " + data.user_name); 
            }
        });           
        },
        disconnect:()=>{
        //Removing the socket on disconnect
        socket.on('disconnect', function() {
         for(var name in clients) {
           if(clients[name].socket === socket.id) {
             delete clients[name];
             break;
           }
         }  
        });         
        }
    }

I have created a repo on github including a more complete version of the above code if anyone is interested: https://github.com/snowballrandom/Memcached-Auth

@toto_tico privkey.pem => key, fullchain.pem => your public cert, chain.pem => ca (i.e certificate authority file) — Kyle Coots, Sep 17 '19 at 21:20
and if I am signing my own certificates with openssl, would the following be correct? `openssl req -newkey rsa:2048 -new -nodes -keyout privkey.pem -out fullchain.pem`, and `openssl x509 -req -days 365 -in fullchain.pem -signkey privkey.pem -out chain.pem` — toto_tico, Sep 18 '19 at 08:38
Yeah that looks right, should have help sections on the comand line for all options if your in linux. — Kyle Coots, Sep 19 '19 at 01:00

score 13 · Answer 4 · answered Apr 28 '16 at 05:51

Was facing the same problem In my case I changed the option parameter of cert to pfx & removed utf8 encoding.

before:

var options = {
    hostname : 'localhost',
    path : '/',
    method : 'POST',
    cert: fs.readFileSync(testCert, 'utf8'),
    passphrase:passphrase,
    agent:false,
    rejectUnauthorized:false
};

after:

var options = {
    hostname : 'localhost',
    path : '/',
    method : 'POST',
    pfx: fs.readFileSync(testCert),
    passphrase:passphrase,
    agent:false,
    rejectUnauthorized:false
};

I get `wrong tag` or `header too long` errors — what can be wrong? — TotalAMD, May 27 '19 at 15:15

score 5 · Answer 5 · answered Apr 19 '19 at 16:40

5

I actually just had this same error message.

The problem was I had key and cert files swapped in the configuration object.

answered Apr 19 '19 at 16:40

H. Green

735
5
10

score 3 · Answer 6 · answered Dec 05 '19 at 00:23

For me, after trying all above solutions it ended up being a problem related to encoding. Concisely, my key was encoded using 'UTF-8 with BOM'. It should be UTF-8 instead.

To fix it, at least using VS Code follow this steps:

Open the file and click on the encoding button at the status bar (at the bottom) and select 'Save with encoding'.
Select UTF-8.
Then try using the certificate again.

I suppose you can use other editors that support saving with the proper encoding.

Source: error:0906d06c:pem routines:pem_read_bio:no start line, when importing godaddy SSL certificate

P.D I did not need to set the encoding to utf-8 option when loading the file using the fs.readFileSync function.

Hope this helps somebody!

score 3 · Answer 7 · answered Mar 22 '20 at 10:50

I faced with the problem like this.

The problem was that I added the public key without '-----BEGIN PUBLIC KEY-----' at the beginning and without '-----END PUBLIC KEY-----'.

So it causes the error.

Initially, my public key was like this:

-----BEGIN PUBLIC KEY-----
WnsbGUXbb0GbJSCwCBAhrzT0s2KMRyqqS7QBiIG7t3H2Qtmde6UoUIcTTPJgv71
......
oNLcaK2wKKyRdcROK7ZTSCSMsJpAFOY
-----END PUBLIC KEY-----

But I used just this part:

WnsbGUXb+b0GbJSCwCBAhrzT0s2KMRyqqS7QBiIG7t3H2Qtmde6UoUIcTTPJgv71
......
oNLcaK2w+KKyRdcROK7ZTSCSMsJpAFOY

It makes sense what you are posting I am familiar with this - does it properly address the issue stated though? — Michael Nelles, Mar 22 '20 at 11:05

score 2 · Answer 8 · answered May 23 '14 at 16:35

If you are using windows, you should make sure that the certificate file csr.pem and key.pem don't have unix-style line endings. Openssl will generate the key files with unix style line endings. You can convert these files to dos format using a utility like unix2dos or a text editor like notepad++

score 2 · Answer 9 · edited Feb 17 '18 at 11:04

2

I guess this is because your nodejs cert has expired. Type this line :
npm set registry http://registry.npmjs.org/
and after that try again with npm install . This actually solved my problem.

edited Feb 17 '18 at 11:04

J4GD33P 51NGH

630
1
8
24

answered Oct 29 '16 at 16:20

Avanthika

3,984
1
12
19

score 2 · Answer 10 · answered Nov 03 '20 at 06:30

2

For me, the solution was to replace \\n (getting formatted into the key in a weird way) in place of \n

Replace your key: <private or public key> with key: (<private or public key>).replace(new RegExp("\\\\n", "\g"), "\n")

answered Nov 03 '20 at 06:30

Olaoye Oluwapelumi

426
5
8

score 0 · Answer 11 · answered Apr 04 '16 at 15:24

0

If you log the

var options = {
  key: fs.readFileSync('./key.pem', 'utf8'),
  cert: fs.readFileSync('./csr.pem', 'utf8')
};

You might notice there are invalid characters due to improper encoding.

answered Apr 04 '16 at 15:24

F.O.O

4,730
4
24
34

score 0 · Answer 12 · answered Sep 19 '19 at 12:17

0

Corrupted cert and/or key files

For me it was just corrupted files. I copied the contents from GitHub PullRequest webpage and I guess I added an extra space somewhere or whatever... once I grabbed the raw thing and replaced the file, it worked.

answered Sep 19 '19 at 12:17

Bugs Bunny

2,496
1
26
32

score -1 · Answer 13 · edited Jun 20 '20 at 09:12

-1

Generate the private key and server certificate with specific expiry date or with infinite(XXX) expiry time and self sign it.

$ openssl req -x509 -sha256 -newkey rsa:2048 -keyout key.pem -out cert.pem -days XXX

$ Enter a private key passphrase...`

Then it will work!

edited Jun 20 '20 at 09:12

Community

1
1

answered Nov 30 '15 at 17:57

Robel Sharma

964
1
11
26

Node.js https pem error: routines:PEM_read_bio:no start line

13 Answers13

Linked

Related