HTTPS and SSL certificates in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when you run this Express HTTPS server code?

Consider this Express server setup using HTTPS. What will the server do when started?

Express

import express from 'express';
import https from 'https';
import fs from 'fs';

const app = express();

app.get('/', (req, res) => {
  res.send('Secure Hello!');
});

const options = {
  key: fs.readFileSync('server.key'),
  cert: fs.readFileSync('server.cert')
};

https.createServer(options, app).listen(8443, () => {
  console.log('HTTPS server running on port 8443');
});

A The server starts on port 8443 and responds with 'Secure Hello!' over HTTPS.

B The server starts but throws an error because Express cannot handle HTTPS directly.

C The server starts on port 8443 but responds with 'Hello' over HTTP, not HTTPS.

D The server fails to start because the key and cert files are missing or invalid.

💡 Hint

Think about how HTTPS servers are created in Node.js with Express.

Using https.createServer with the Express app and valid key and cert files creates a secure HTTPS server. The app responds to requests over HTTPS on the specified port.

📝 Syntax

intermediate

Which option correctly reads SSL certificate files for HTTPS in Express?

You want to create an HTTPS server in Express. Which code snippet correctly reads the SSL key and certificate files?

A const options = { key: fs.readFileSync('key.pem'), cert: fs.readFileSync('cert.pem') };

B const options = { key: fs.readFile('key.pem'), cert: fs.readFile('cert.pem') };

C const options = { key: fs.readFileSync('key.pem'), cert: 'cert.pem' };

D const options = { key: 'key.pem', cert: 'cert.pem' };

💡 Hint

Remember that the HTTPS server needs the actual file contents, not just file names.

fs.readFileSync reads the file contents synchronously, which is required for the HTTPS options. Using fs.readFile is asynchronous and returns a Promise or requires a callback, so it won't work here directly.

🔧 Debug

advanced

Why does this HTTPS Express server crash with 'Error: error:0909006C:PEM routines:get_name:no start line'?

Look at this code snippet. Why does the server crash with the PEM error when starting?

Express

import express from 'express';
import https from 'https';
import fs from 'fs';

const app = express();

const options = {
  key: fs.readFileSync('server.key'),
  cert: fs.readFileSync('server.cert')
};

https.createServer(options, app).listen(443);

A The port 443 is already in use by another process.

B The server.key and server.cert files are missing from the directory.

C The key and cert files are read as strings but should be read as buffers without encoding.

D Express app is missing a route handler, causing the crash.

💡 Hint

PEM errors often relate to how the certificate files are read or formatted.

Reading the key and cert files with 'utf8' encoding returns strings, but Node.js HTTPS expects buffers or raw data. Reading without encoding returns buffers, which is correct.

❓ state_output

advanced

What is the output when accessing the HTTP server that redirects to HTTPS?

Given this Express setup, what response does a client get when requesting http://localhost:3000?

Express

import express from 'express';

const app = express();

app.use((req, res, next) => {
  if (!req.secure) {
    return res.redirect('https://' + req.headers.host + req.url);
  }
  next();
});

app.get('/', (req, res) => {
  res.send('Welcome to secure site');
});

app.listen(3000, () => console.log('HTTP server running on port 3000'));

A The client receives a 404 Not Found error.

B The client receives the text 'Welcome to secure site' over HTTP.

C The server crashes because req.secure is undefined.

D The client receives a 302 redirect to the HTTPS version of the URL.

💡 Hint

Check what happens when req.secure is false in Express middleware.

The middleware checks if the request is not secure (HTTP). If so, it sends a redirect response to the HTTPS URL, causing the client to switch to HTTPS.

🧠 Conceptual

expert

Why is it important to use a trusted SSL certificate in production Express HTTPS servers?

Choose the best reason why production HTTPS servers should use certificates from trusted Certificate Authorities (CAs).

A Self-signed certificates are faster to generate and improve server performance.

B Browsers trust certificates from known CAs, preventing security warnings and ensuring encrypted communication.

C Trusted certificates allow the server to run on any port without restrictions.

D Using trusted certificates disables the need for HTTPS middleware in Express.

💡 Hint

Think about user experience and browser security when visiting HTTPS sites.

Browsers show warnings for self-signed or untrusted certificates, which can scare users and reduce trust. Trusted certificates ensure secure, trusted connections.