FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: fix broken TLS security level example · nodejs/node@dae4341 · GitHub

/ node Public

Commit dae4341

Browse files
soreavis
authored and
aduh95
committed
doc: fix broken TLS security level example
The example under "Setting security levels" does not run. The client sets `maxVersion: 'TLSv1'` while its `minVersion` stays at the `tls.DEFAULT_MIN_VERSION` default of `'TLSv1.2'`, so no version overlaps and the connection fails with ERR_SSL_NO_PROTOCOLS_AVAILABLE. Setting the client's `minVersion` is not enough on its own: the handshake then fails with an alert 40, because `createServer` is given no key or certificate and the server has no shared cipher. Set `minVersion` on the client, add the key and certificate placeholders and the openssl recipe that the other sections using them already carry, pass the server certificate as the client's `ca`, and use port 8000 like the rest of the file. The section now runs from an empty directory and prints "Client connected with protocol: TLSv1". Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com> PR-URL: #65391 Fixes: #60569 Refs: #60571 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 35b18b4 commit dae4341

1 file changed

Lines changed: 35 additions & 6 deletions

File tree

‎doc/api/tls.md‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -468,35 +468,64 @@ to set the security level to 0 while using the default OpenSSL cipher list, you
468468

469469
```mjs
470470
import { createServer, connect } from 'node:tls';
471-
const port = 443;
471+
import { readFileSync } from 'node:fs';
472+
const port = 8000;
472473

473-
createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) {
474+
createServer({
475+
key: readFileSync('server-key.pem'),
476+
cert: readFileSync('server-cert.pem'),
477+
ciphers: 'DEFAULT@SECLEVEL=0',
478+
minVersion: 'TLSv1',
479+
}, function(socket) {
474480
console.log('Client connected with protocol:', socket.getProtocol());
475481
socket.end();
476482
this.close();
477483
})
478484
.listen(port, () => {
479-
connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' });
485+
connect(port, {
486+
ciphers: 'DEFAULT@SECLEVEL=0',
487+
minVersion: 'TLSv1',
488+
maxVersion: 'TLSv1',
489+
ca: [ readFileSync('server-cert.pem') ],
490+
});
480491
});
481492
```
482493

483494
```cjs
484495
const { createServer, connect } = require('node:tls');
485-
const port = 443;
496+
const { readFileSync } = require('node:fs');
497+
const port = 8000;
486498

487-
createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) {
499+
createServer({
500+
key: readFileSync('server-key.pem'),
501+
cert: readFileSync('server-cert.pem'),
502+
ciphers: 'DEFAULT@SECLEVEL=0',
503+
minVersion: 'TLSv1',
504+
}, function(socket) {
488505
console.log('Client connected with protocol:', socket.getProtocol());
489506
socket.end();
490507
this.close();
491508
})
492509
.listen(port, () => {
493-
connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' });
510+
connect(port, {
511+
ciphers: 'DEFAULT@SECLEVEL=0',
512+
minVersion: 'TLSv1',
513+
maxVersion: 'TLSv1',
514+
ca: [ readFileSync('server-cert.pem') ],
515+
});
494516
});
495517
```
496518

497519
This approach sets the security level to 0, allowing the use of legacy features while still
498520
leveraging the default OpenSSL ciphers.
499521

522+
To generate the certificate and key for this example, run:
523+
524+
```bash
525+
openssl req -x509 -newkey rsa:2048 -nodes -sha256 -subj '/CN=localhost' \
526+
-keyout server-key.pem -out server-cert.pem
527+
```
528+
500529
### Using [`--tls-cipher-list`][]
501530

502531
You can also set the security level and ciphers from the command line using the

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL