FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: doc-only deprecate OpenSSL engine-based APIs · nodejs/node@3445c08 · GitHub

/ node Public

Commit 3445c08

Browse files
richardlau
authored and
marco-ippolito
committed
doc: doc-only deprecate OpenSSL engine-based APIs
OpenSSL 3 deprecated support for custom engines with a recommendation to switch to its new provider model. PR-URL: #53329 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent d1a7800 commit 3445c08

4 files changed

Lines changed: 48 additions & 7 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5389,12 +5389,17 @@ added: v15.6.0
53895389

53905390
<!-- YAML
53915391
added: v0.11.11
5392+
changes:
5393+
- version: REPLACEME
5394+
pr-url: https://github.com/nodejs/node/pull/53329
5395+
description: Custom engine support in OpenSSL 3 is deprecated.
53925396
-->
53935397

53945398
* `engine` {string}
53955399
* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
53965400

53975401
Load and set the `engine` for some or all OpenSSL functions (selected by flags).
5402+
Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
53985403

53995404
`engine` could be either an id or a path to the engine's shared library.
54005405

‎doc/api/deprecations.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3526,6 +3526,23 @@ For ciphers in GCM mode, the [`decipher.setAuthTag()`][] function accepts
35263526
authentication tags of any valid length (see [DEP0090](#DEP0090)). This behavior
35273527
is deprecated to better align with recommendations per [NIST SP 800-38D][].
35283528

3529+
### DEP0183: OpenSSL engine-based APIs
3530+
3531+
<!-- YAML
3532+
changes:
3533+
- version: REPLACEME
3534+
pr-url: https://github.com/nodejs/node/pull/53329
3535+
description: Documentation-only deprecation.
3536+
-->
3537+
3538+
Type: Documentation-only
3539+
3540+
OpenSSL 3 has deprecated support for custom engines with a recommendation to
3541+
switch to its new provider model. The `clientCertEngine` option for
3542+
`https.request()`, [`tls.createSecureContext()`][], and [`tls.createServer()`][];
3543+
the `privateKeyEngine` and `privateKeyIdentifier` for [`tls.createSecureContext()`][];
3544+
and [`crypto.setEngine()`][] all depend on this functionality from OpenSSL.
3545+
35293546
[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
35303547
[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
35313548
[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
@@ -3570,6 +3587,7 @@ is deprecated to better align with recommendations per [NIST SP 800-38D][].
35703587
[`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
35713588
[`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
35723589
[`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
3590+
[`crypto.setEngine()`]: crypto.md#cryptosetengineengine-flags
35733591
[`decipher.final()`]: crypto.md#decipherfinaloutputencoding
35743592
[`decipher.setAuthTag()`]: crypto.md#deciphersetauthtagbuffer-encoding
35753593
[`diagnostics_channel.subscribe(name, onMessage)`]: diagnostics_channel.md#diagnostics_channelsubscribename-onmessage
@@ -3648,6 +3666,7 @@ is deprecated to better align with recommendations per [NIST SP 800-38D][].
36483666
[`tls.TLSSocket`]: tls.md#class-tlstlssocket
36493667
[`tls.checkServerIdentity()`]: tls.md#tlscheckserveridentityhostname-cert
36503668
[`tls.createSecureContext()`]: tls.md#tlscreatesecurecontextoptions
3669+
[`tls.createServer()`]: tls.md#tlscreateserveroptions-secureconnectionlistener
36513670
[`url.format()`]: url.md#urlformaturlobject
36523671
[`url.parse()`]: url.md#urlparseurlstring-parsequerystring-slashesdenotehost
36533672
[`url.resolve()`]: url.md#urlresolvefrom-to

‎doc/api/https.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,10 @@ a `timeout` of 5 seconds.
342342
<!-- YAML
343343
added: v0.3.6
344344
changes:
345+
- version: REPLACEME
346+
pr-url: https://github.com/nodejs/node/pull/53329
347+
description: The `clientCertEngine` option depends on custom engine
348+
support in OpenSSL which is deprecated in OpenSSL 3.
345349
- version:
346350
- v16.7.0
347351
- v14.18.0
@@ -377,7 +381,7 @@ changes:
377381
Makes a request to a secure web server.
378382

379383
The following additional `options` from [`tls.connect()`][] are also accepted:
380-
`ca`, `cert`, `ciphers`, `clientCertEngine`, `crl`, `dhparam`, `ecdhCurve`,
384+
`ca`, `cert`, `ciphers`, `clientCertEngine` (deprecated), `crl`, `dhparam`, `ecdhCurve`,
381385
`honorCipherOrder`, `key`, `passphrase`, `pfx`, `rejectUnauthorized`,
382386
`secureOptions`, `secureProtocol`, `servername`, `sessionIdContext`,
383387
`highWaterMark`.

‎doc/api/tls.md‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1799,7 +1799,14 @@ argument.
17991799
<!-- YAML
18001800
added: v0.11.13
18011801
changes:
1802-
- version: v19.8.0
1802+
- version: REPLACEME
1803+
pr-url: https://github.com/nodejs/node/pull/53329
1804+
description: The `clientCertEngine`, `privateKeyEngine` and
1805+
`privateKeyIdentifier` options depend on custom engine
1806+
support in OpenSSL which is deprecated in OpenSSL 3.
1807+
- version:
1808+
- v19.8.0
1809+
- v18.16.0
18031810
pr-url: https://github.com/nodejs/node/pull/46978
18041811
description: The `dhparam` option can now be set to `'auto'` to
18051812
enable DHE with appropriate well-known parameters.
@@ -1884,7 +1891,7 @@ changes:
18841891
ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be
18851892
uppercased in order for OpenSSL to accept them.
18861893
* `clientCertEngine` {string} Name of an OpenSSL engine which can provide the
1887-
client certificate.
1894+
client certificate. **Deprecated.**
18881895
* `crl` {string|string\[]|Buffer|Buffer\[]} PEM formatted CRLs (Certificate
18891896
Revocation Lists).
18901897
* `dhparam` {string|Buffer} `'auto'` or custom Diffie-Hellman parameters,
@@ -1912,11 +1919,11 @@ changes:
19121919
decrypted with `object.passphrase` if provided, or `options.passphrase` if
19131920
it is not.
19141921
* `privateKeyEngine` {string} Name of an OpenSSL engine to get private key
1915-
from. Should be used together with `privateKeyIdentifier`.
1922+
from. Should be used together with `privateKeyIdentifier`. **Deprecated.**
19161923
* `privateKeyIdentifier` {string} Identifier of a private key managed by
19171924
an OpenSSL engine. Should be used together with `privateKeyEngine`.
19181925
Should not be set together with `key`, because both options define a
1919-
private key in different ways.
1926+
private key in different ways. **Deprecated.**
19201927
* `maxVersion` {string} Optionally set the maximum TLS version to allow. One
19211928
of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified
19221929
along with the `secureProtocol` option; use one or the other.
@@ -2053,7 +2060,13 @@ where `secureSocket` has the same API as `pair.cleartext`.
20532060
<!-- YAML
20542061
added: v0.3.2
20552062
changes:
2056-
- version: v20.4.0
2063+
- version: REPLACEME
2064+
pr-url: https://github.com/nodejs/node/pull/53329
2065+
description: The `clientCertEngine` option depends on custom engine
2066+
support in OpenSSL which is deprecated in OpenSSL 3.
2067+
- version:
2068+
- v20.4.0
2069+
- v18.19.0
20572070
pr-url: https://github.com/nodejs/node/pull/45190
20582071
description: The `options` parameter can now include `ALPNCallback`.
20592072
- version: v19.0.0
@@ -2098,7 +2111,7 @@ changes:
20982111
protocols, an error will be thrown. This option cannot be used with the
20992112
`ALPNProtocols` option, and setting both options will throw an error.
21002113
* `clientCertEngine` {string} Name of an OpenSSL engine which can provide the
2101-
client certificate.
2114+
client certificate. **Deprecated.**
21022115
* `enableTrace` {boolean} If `true`, [`tls.TLSSocket.enableTrace()`][] will be
21032116
called on new connections. Tracing can be enabled after the secure
21042117
connection is established, but this option must be used to trace the secure

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL