title: nodejs - UNABLE_TO_VERIFY_LEAF_SIGNATURE with self-signed certificate
body: <p>I'm trying to make node <code>https</code> work with a self-signed certificate with a request coming to IP address instead of a DNS name. I'm using this code</p>
  
  <pre><code>var tls = require('tls');
  var fs = require('fs');
  
  var cert = fs.readFileSync(__dirname + '/cert.pem');
  var key = fs.readFileSync(__dirname + '/key.pem');
  
  var netServer = new tls.Server(options = { key: key, cert: cert });
  var port = 54321;
  
  netServer.listen(port);
  
  netServer.on('secureConnection', function(socket) {
      socket.end('heyyyoooo');
  });
  
  var client = tls.connect(port, 'localhost', {
      ca: [ cert ],
      rejectUnauthorized: true
  });
  
  client.on('data', function(data) {
      console.log(data.toString());
      process.exit();
  });
  </code></pre>
  
  <p>It works fine with the cert generated by <a href="http://nodejs.org/api/tls.html#tls_tls_ssl">these instructions</a> (without Subject Alternative Names) when the request is issued to <code>localhost</code>, however when I replace it with <code>127.0.0.1</code>, I get <code>Error: Hostname/IP doesn't match certificate's altnames</code>. So I've created a new certificate generating with <code>subjectAltName</code>. Openssl reads it as:</p>
  
  <pre><code>    Certificate:
          Data:
              Version: 3 (0x2)
              Serial Number: 11107838472034892631 (0x9a26f83d0c0ebb57)
          Signature Algorithm: sha1WithRSAEncryption
              Issuer: CN=127.0.0.1
              Validity
                  Not Before: Jun 24 09:51:56 2013 GMT
                  Not After : Jun 22 09:51:56 2023 GMT
              Subject: CN=127.0.0.1
              Subject Public Key Info:
                  Public Key Algorithm: rsaEncryption
                      Public-Key: (1024 bit)
                      Modulus: *skipped*
                      Exponent: 65537 (0x10001)
              X509v3 extensions:
                  X509v3 Key Usage: 
                      Key Encipherment, Data Encipherment
                  X509v3 Extended Key Usage: 
                      TLS Web Server Authentication
                  X509v3 Subject Alternative Name: 
                      DNS:localhost, IP Address:127.0.0.1
          Signature Algorithm: sha1WithRSAEncryption
  *skipped*
  </code></pre>
  
  <p>So the SANs were created properly. Now I'm getting <code>Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE</code>, how do I make it work?</p>