Commit ddc5afd
doc: warn that tls.connect() doesn't set SNI
Add a note warning users that when using tls.connect(),
the `servername` option must be set explicitely to enable
SNI, otherwise the connection could fail.
PR-URL: #33855
Fixes: #28167
Co-authored-by: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>1 parent d77eaee commit ddc5afd
1 file changed
Lines changed: 6 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1392,6 +1392,12 @@ The `callback` function, if specified, will be added as a listener for the | |||
| 1392 | 1392 | ||
| 1393 | 1393 | `tls.connect()` returns a [`tls.TLSSocket`][] object. | |
| 1394 | 1394 | ||
| 1395 | + Unlike the `https` API, `tls.connect()` does not enable the | ||
| 1396 | + SNI (Server Name Indication) extension by default, which may cause some | ||
| 1397 | + servers to return an incorrect certificate or reject the connection | ||
| 1398 | + altogether. To enable SNI, set the `servername` option in addition | ||
| 1399 | + to `host`. | ||
| 1400 | + | ||
| 1395 | 1401 | The following illustrates a client for the echo server example from | |
| 1396 | 1402 | [`tls.createServer()`][]: | |
| 1397 | 1403 | ||
0 commit comments