tls.createServer secureOptions

[kobelb]

I was looking for a way to limit the versions of TLS that are supported, and I came across the secureOptions in the tls.createServer method that appears to do exactly that.

However, I noticed that the documentation doesn't reference this option. Is this something that a pull request to modify the docs would be appropriate, or is this something that you all intend to deprecate/remove in the near-future?

[mscdex]

I'm assuming you meant secureProtocol? If so, I'm not sure what is missing since there is a link to the OpenSSL documentation that shows the valid names. Unless you're asking to include that inline in the node documentation?

[kobelb]

I'm sorry for being unclear earlier, I've tried to document below what I've traced through the code.

The constructor for the tls Server calls self.setOptions, which has the following line: https://github.com/nodejs/node/blob/master/lib/_tls_wrap.js#L901

that ends up getting passed again by: https://github.com/nodejs/node/blob/master/lib/_tls_wrap.js#L761

which is passed to the SecureContext constructor as flags:
https://github.com/nodejs/node/blob/master/lib/_tls_common.js#L45

which is then passed again by:
https://github.com/nodejs/node/blob/master/lib/_tls_common.js#L32

ending with it calling the SecureContext::SetOptions method that passes through the options to OpenSSL here: https://github.com/nodejs/node/blob/master/src/node_crypto.cc#L875

[kobelb]

@mscdex I know you're very busy, any chance you've had a chance to to look at my clarifications?

[mscdex]

Why not use secureProtocol?

[kobelb]

For my specific use-case, we can get a greater degree of flexibility by allowing users to blacklist TLSv1 while continuing to support TLSv1.1 and TLSv1.2.

[mscdex]

/cc @nodejs/crypto

[bnoordhuis]

secureOptions is not deprecated and documenting it is acceptable. I think the reason we haven't done that before is that most options are fairly subtle and require some understanding from the reader on the inner workings of openssl and TLS. You could start with SSL_OP_NO_TLSv1 and friends, those are pretty straightforward.

[kobelb]

Fantastic, thanks @bnoordhuis. I'll get a pull request together for this.

[sam-github]

closed by #9800, see #9340 (comment)