Commit 8b531da
doc: clarify supported versus enabled TLS ciphers
PR-URL: #42063
Refs: #42059
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent a2926c4 commit 8b531da
1 file changed
Lines changed: 5 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1787,7 +1787,7 @@ changes: | |||
| 1787 | 1787 | See [OpenSSL man pages](https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_sigalgs_list.html) | |
| 1788 | 1788 | for more info. | |
| 1789 | 1789 | * `ciphers` {string} Cipher suite specification, replacing the default. For | |
| 1790 | - more information, see [modifying the default cipher suite][]. Permitted | ||
| 1790 | + more information, see [Modifying the default TLS cipher suite][]. Permitted | ||
| 1791 | 1791 | ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be | |
| 1792 | 1792 | uppercased in order for OpenSSL to accept them. | |
| 1793 | 1793 | * `clientCertEngine` {string} Name of an OpenSSL engine which can provide the | |
@@ -2089,6 +2089,9 @@ Returns an array with the names of the supported TLS ciphers. The names are | |||
| 2089 | 2089 | lower-case for historical reasons, but must be uppercased to be used in | |
| 2090 | 2090 | the `ciphers` option of [`tls.createSecureContext()`][]. | |
| 2091 | 2091 | ||
| 2092 | + Not all supported ciphers are enabled by default. See | ||
| 2093 | + [Modifying the default TLS cipher suite][]. | ||
| 2094 | + | ||
| 2092 | 2095 | Cipher names that start with `'tls_'` are for TLSv1.3, all the others are for | |
| 2093 | 2096 | TLSv1.2 and below. | |
| 2094 | 2097 | ||
@@ -2157,6 +2160,7 @@ added: v11.4.0 | |||
| 2157 | 2160 | [Chrome's 'modern cryptography' setting]: https://www.chromium.org/Home/chromium-security/education/tls#TOC-Cipher-Suites | |
| 2158 | 2161 | [DHE]: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange | |
| 2159 | 2162 | [ECDHE]: https://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman | |
| 2163 | + [Modifying the default TLS cipher suite]: #modifying-the-default-tls-cipher-suite | ||
| 2160 | 2164 | [Mozilla's publicly trusted list of CAs]: https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt | |
| 2161 | 2165 | [OCSP request]: https://en.wikipedia.org/wiki/OCSP_stapling | |
| 2162 | 2166 | [OpenSSL Options]: crypto.md#openssl-options | |
@@ -2208,6 +2212,5 @@ added: v11.4.0 | |||
| 2208 | 2212 | [certificate object]: #certificate-object | |
| 2209 | 2213 | [cipher list format]: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html#CIPHER-LIST-FORMAT | |
| 2210 | 2214 | [forward secrecy]: https://en.wikipedia.org/wiki/Perfect_forward_secrecy | |
| 2211 | - [modifying the default cipher suite]: #modifying-the-default-tls-cipher-suite | ||
| 2212 | 2215 | [perfect forward secrecy]: #perfect-forward-secrecy | |
| 2213 | 2216 | [specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html | |
0 commit comments