title: How to setup 2 way SSL between 2 node js server or between node js server and tomcat
body: <p>I would like to setup 2 way SSL between 2 Node.js server. OR between nodejs server and tomcat server. </p>
  
  <p>In my case, I have a backend server is tomcat where it only accepts valid SSL client requests (clientAuth="true"). My node js server acts as a client to backend tomcat server. When clientauth=false then everything works fine, but when clientauth=true then connection fails to establish. </p>
  
  <p>I have enable logs at backend server, I can see empty certificate received from node js so certificate chain is missing so trust is not established and connection fails.</p>
  
  <p>Can anyone help me to understand how to supply node js own certificate(which is client certificate in this case) to backend server. </p>
  
  <p>I am using self sign certificates for this test, all these are available in appropriate certificate stores.</p>
  
  <pre><code>12:57:33,477 INFO  [STDOUT] upcoming handshake states: server finished[20]
  12:57:33,477 INFO  [STDOUT] *** Certificate chain
  12:57:33,477 INFO  [STDOUT] &lt;Empty&gt;
  12:57:33,477 INFO  [STDOUT] ***
  12:57:33,477 INFO  [STDOUT] Thread-34, fatal error: 42: null cert chain
  javax.net.ssl.SSLHandshakeException: null cert chain
  12:57:33,478 INFO  [STDOUT] %% Invalidated:  [Session-10, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
  12:57:33,478 INFO  [STDOUT] Thread-34
  12:57:33,478 INFO  [STDOUT] , SEND TLSv1.2 ALERT:
  12:57:33,478 INFO  [STDOUT] fatal,
  12:57:33,478 INFO  [STDOUT] description = bad_certificate
  12:57:33,478 INFO  [STDOUT] Thread-34, WRITE: TLSv1.2 Alert, length = 2
  </code></pre>
  
  <p>Basically tomcat host my REST and nodejs server access those REST endpoints. I am using standard https library at nodejs.  </p>
  
  <pre><code>const https = require('https');
  
  const options = {
    key: fs.readFileSync("/key.pem"),
    cert: fs.readFileSync("/chain.pem"),
    ca: fs.readFileSync("/ca.pem")
  };
  
  https.createServer(options, app).listen(port, host, () =&gt; {
  </code></pre>
  
  <p>SSL validation doing only for servers. There is no client directly connects to backend server only other servers can access it. All CA certificates are properly installed in backend truststore.</p>