Using an SSL certificate in Node.js

Node will not fetch missing intermediates for you, so cert has to be the fullchain.

const https = require("node:https");
const fs = require("node:fs");

https.createServer({
  cert: fs.readFileSync("/etc/ssl/certs/fullchain.pem"),
  key:  fs.readFileSync("/etc/ssl/private/example.com.key"),
  minVersion: "TLSv1.2",
}, app).listen(443);

Terminating TLS in the application means restarting the app on every renewal, and running it as root or juggling capabilities to bind 443. Putting nginx or Caddy in front and speaking plain HTTP on localhost is almost always the better shape — it is what this toolkit itself expects.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what Node.js actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Using an SSL certificate in Node.js

Verify it from the outside

Other platforms