title: Confusion on SSL with Node and using cURL
body: <p>I have setup my secure Node server as:</p>
  
  <pre><code>var HTTPSOptions = {
      hostname: config.hostname,
      cert: fs.readFileSync(config.ssl.cert_path),
      key: fs.readFileSync(config.ssl.key_path),
      requestCert: true,
      rejectUnauthorized: false,
      passphrase: config.ssl.ca_key_password
  };
  HTTPSOptions.agent = new https.Agent(HTTPSOptions);
  var httpsServer = https.createServer(HTTPSOptions, app).listen(config.https_port, function () {
      console.info("HTTPS server running on %d", config.https_port);
  });
  </code></pre>
  
  <p>I've also generated a <code>client.key</code>, <code>client.crt</code> and <code>client.csr</code> for one of my clients and signed it with the server's <code>.key</code> and <code>.crt</code>.</p>
  
  <p>Now, I want to connect to my API from a client. Reading on how cURL works, I used:</p>
  
  <pre><code>curl --key client.key --cert client.crt:clientPassword mySecureSite.com\api\call
  </code></pre>
  
  <p>This works fine, except that the same code would work if I provide any key/cert or any password, or even if I don't provide any key/cert! </p>
  
  <p>Can someone please enlighten me?</p>