Hi Tom,
There are two parts to the problem:
- acquiring your certificate
- deploying it to your service (and using it within your service)
It sounds like you are managing to get your certificate OK, http validation on port 80 is the easiest and the app will temporarily listen to port 80 for you if you have nothing else (other than IIS) using that port. You can also optionally use DNS validation which involves updating a DNS TXT record each time you renew, that’s best done using a supported API: DNS Validation (dns-01) | Certify The Web Docs
For deployment, it depends on what the target service needs and in your case your probably developing an Express based app in node. Looking at an example like: How to Create an HTTPS NodeJS Web Sevice with Express you would want to export the certificate as a certificate file and a private key file. You can do this using the Tasks feature, add a Deploy to Generic Server task (even just the same as Deploy To Apache: Deployment Task - Deploy to Apache | Certify The Web Docs ) then run that to export the files you need. I would suggest you use the Full Chain option (and the private key option) to export your certificate file as this outputs your certificate plus any intermediate CA certificates the server might need.
Your app then needs to load those files and setup the https listener. By default a simple app will be listening for http requests on a whatever port you assign the app to, to get https (TLS) to work you need to explicitly be listening for a TLS conversation as it has a different protocol for how the conversation takes place. So in the above linked example you need to review the Enabling HTTPS Nodejs in Express step (the other stuff like openssl commands etc are not relevant if you already have your certificate files). It mainly looks like:
https
.createServer(
// Provide the private and public key to the server by reading each
// file's content with the readFileSync() method.
{
key: fs.readFileSync("key.pem"),
cert: fs.readFileSync("cert.pem"),
},
app
)
.listen(4000, () => {
console.log("server is running at port 4000");
});
The difference here is that specifying the certificate and key turns the server in the given port into a TLS listener, talking https. The specific choice of port number doesn’t really matter, it’s just conventional. Note that you would now need to load the app as https://<yourdomain>:4000 as standard http conversations would no longer work once TLS is enabled.
It’s also important to note that when your certificate renews you may need to restart your service or otherwise tell it to load the latest cert. The simplest way is to use a script task to restart your node server (as your last task under Tasks > Deployment Tasks), otherwise you’d need to signal your application somehow to get it to load the latest certificate files.
Another completely and common different strategy is to reverse proxy your application via a web server (IIS is a good choice). This involves setting up an IIS site which acts as your front end for https requests and it then forwards the requests to your backend app via http (e.g. http://localhost:4000). You would then just use Certify to renew the cert against IIS (which is knows how to do by default, using the hostname specified in your website bindings).