node.js can i use multiple ssl certificates and keys for same project and how?

Question

i have my paypal ssl certificate for the paypal ipn added for my code like that and it working without any problems

var httpsOptions = {
    key: fs.readFileSync('./app/certsandkeys/my-prvkey.pem'),
    cert: fs.readFileSync('./app/certsandkeys/my-pubcert.pem'),
    requestCert: true
    //pfx: fs.readFileSync('./app/certsandkeys/ssl/crt.pfx'),
    //passphrase:"password"
}

https.createServer(httpsOptions, app).listen(443,function (req,res) {
    console.log("server listening on port " + 443);
});

but what i need now is to certificating my whole site so i created an ssl cert and key using openssl (server.crt and server.csr and server.key ) but now i don't know how to add it beside the paypal ipn cert and key on httpsOptions

the only thing i found about something like that is this code from github issues

var options = {
    key: [key1, key2],
    cert: [cert1, cert2],
    ca: caCert
};
var server = https.createServer(options);

so what's the right way for doing that ?

Answer 1

Using different keys on the same server is handled by Server Name Indication (SNI) and requires different domain names for the different servers. This question shows how SNI would be used to create a different security context for the second domain name.

Changing that code for a key in the default context should look something like this:

const secondContext = tls.createSecureContext({
    key: [key2],
    cert: [cert2]
});


const options = {
    key: [key1],
    cert: [cert1],
    SNICallback: function (domain, cb) {
      if (domain === 'key2domain.example.com') {
         cb(null, secondContext);
      } else {
         cb();
      }
    }
}

It's not clear from the paypal docs you refer to whether paypal is having you set up an alternate domain for this IPN service URL. Instead, it looks like their process accepts a CSR to handle self-signed certs for IPN-only use and offers a payed signing of it to use it for user visible buttons, i.e. they offer their own CA service?

You can submit multiple CSRs on the same key, so you could try relying on a single private key and keep a certificate chain from a normal CA. But if they enforce usage of their own certificate chain, then you will probably need to create a separate (sub)domain for this usage to provide different chains with SNI.