FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: doc-only deprecate OpenSSL engine-based APIs · nodejs/node@df47627 · GitHub

/ node Public

Commit df47627

Browse files
richardlau
authored and
targos
committed
doc: doc-only deprecate OpenSSL engine-based APIs
OpenSSL 3 deprecated support for custom engines with a recommendation to switch to its new provider model. PR-URL: #53329 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 515dd24 commit df47627

4 files changed

Lines changed: 42 additions & 5 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5270,12 +5270,17 @@ added: v15.6.0
52705270

52715271
<!-- YAML
52725272
added: v0.11.11
5273+
changes:
5274+
- version: REPLACEME
5275+
pr-url: https://github.com/nodejs/node/pull/53329
5276+
description: Custom engine support in OpenSSL 3 is deprecated.
52735277
-->
52745278

52755279
* `engine` {string}
52765280
* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
52775281

52785282
Load and set the `engine` for some or all OpenSSL functions (selected by flags).
5283+
Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
52795284

52805285
`engine` could be either an id or a path to the engine's shared library.
52815286

‎doc/api/deprecations.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3638,6 +3638,23 @@ For ciphers in GCM mode, the [`decipher.setAuthTag()`][] function accepts
36383638
authentication tags of any valid length (see [DEP0090](#DEP0090)). This behavior
36393639
is deprecated to better align with recommendations per [NIST SP 800-38D][].
36403640

3641+
### DEP0183: OpenSSL engine-based APIs
3642+
3643+
<!-- YAML
3644+
changes:
3645+
- version: REPLACEME
3646+
pr-url: https://github.com/nodejs/node/pull/53329
3647+
description: Documentation-only deprecation.
3648+
-->
3649+
3650+
Type: Documentation-only
3651+
3652+
OpenSSL 3 has deprecated support for custom engines with a recommendation to
3653+
switch to its new provider model. The `clientCertEngine` option for
3654+
`https.request()`, [`tls.createSecureContext()`][], and [`tls.createServer()`][];
3655+
the `privateKeyEngine` and `privateKeyIdentifier` for [`tls.createSecureContext()`][];
3656+
and [`crypto.setEngine()`][] all depend on this functionality from OpenSSL.
3657+
36413658
[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
36423659
[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
36433660
[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
@@ -3680,6 +3697,7 @@ is deprecated to better align with recommendations per [NIST SP 800-38D][].
36803697
[`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
36813698
[`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
36823699
[`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
3700+
[`crypto.setEngine()`]: crypto.md#cryptosetengineengine-flags
36833701
[`decipher.final()`]: crypto.md#decipherfinaloutputencoding
36843702
[`decipher.setAuthTag()`]: crypto.md#deciphersetauthtagbuffer-encoding
36853703
[`diagnostics_channel.subscribe(name, onMessage)`]: diagnostics_channel.md#diagnostics_channelsubscribename-onmessage
@@ -3758,6 +3776,7 @@ is deprecated to better align with recommendations per [NIST SP 800-38D][].
37583776
[`tls.TLSSocket`]: tls.md#class-tlstlssocket
37593777
[`tls.checkServerIdentity()`]: tls.md#tlscheckserveridentityhostname-cert
37603778
[`tls.createSecureContext()`]: tls.md#tlscreatesecurecontextoptions
3779+
[`tls.createServer()`]: tls.md#tlscreateserveroptions-secureconnectionlistener
37613780
[`url.format()`]: url.md#urlformaturlobject
37623781
[`url.parse()`]: url.md#urlparseurlstring-parsequerystring-slashesdenotehost
37633782
[`url.resolve()`]: url.md#urlresolvefrom-to

‎doc/api/https.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,10 @@ a `timeout` of 5 seconds.
342342
<!-- YAML
343343
added: v0.3.6
344344
changes:
345+
- version: REPLACEME
346+
pr-url: https://github.com/nodejs/node/pull/53329
347+
description: The `clientCertEngine` option depends on custom engine
348+
support in OpenSSL which is deprecated in OpenSSL 3.
345349
- version:
346350
- v16.7.0
347351
- v14.18.0
@@ -377,7 +381,7 @@ changes:
377381
Makes a request to a secure web server.
378382

379383
The following additional `options` from [`tls.connect()`][] are also accepted:
380-
`ca`, `cert`, `ciphers`, `clientCertEngine`, `crl`, `dhparam`, `ecdhCurve`,
384+
`ca`, `cert`, `ciphers`, `clientCertEngine` (deprecated), `crl`, `dhparam`, `ecdhCurve`,
381385
`honorCipherOrder`, `key`, `passphrase`, `pfx`, `rejectUnauthorized`,
382386
`secureOptions`, `secureProtocol`, `servername`, `sessionIdContext`,
383387
`highWaterMark`.

‎doc/api/tls.md‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1799,6 +1799,11 @@ argument.
17991799
<!-- YAML
18001800
added: v0.11.13
18011801
changes:
1802+
- version: REPLACEME
1803+
pr-url: https://github.com/nodejs/node/pull/53329
1804+
description: The `clientCertEngine`, `privateKeyEngine` and
1805+
`privateKeyIdentifier` options depend on custom engine
1806+
support in OpenSSL which is deprecated in OpenSSL 3.
18021807
- version:
18031808
- v19.8.0
18041809
- v18.16.0
@@ -1886,7 +1891,7 @@ changes:
18861891
ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be
18871892
uppercased in order for OpenSSL to accept them.
18881893
* `clientCertEngine` {string} Name of an OpenSSL engine which can provide the
1889-
client certificate.
1894+
client certificate. **Deprecated.**
18901895
* `crl` {string|string\[]|Buffer|Buffer\[]} PEM formatted CRLs (Certificate
18911896
Revocation Lists).
18921897
* `dhparam` {string|Buffer} `'auto'` or custom Diffie-Hellman parameters,
@@ -1914,11 +1919,11 @@ changes:
19141919
decrypted with `object.passphrase` if provided, or `options.passphrase` if
19151920
it is not.
19161921
* `privateKeyEngine` {string} Name of an OpenSSL engine to get private key
1917-
from. Should be used together with `privateKeyIdentifier`.
1922+
from. Should be used together with `privateKeyIdentifier`. **Deprecated.**
19181923
* `privateKeyIdentifier` {string} Identifier of a private key managed by
19191924
an OpenSSL engine. Should be used together with `privateKeyEngine`.
19201925
Should not be set together with `key`, because both options define a
1921-
private key in different ways.
1926+
private key in different ways. **Deprecated.**
19221927
* `maxVersion` {string} Optionally set the maximum TLS version to allow. One
19231928
of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified
19241929
along with the `secureProtocol` option; use one or the other.
@@ -2055,6 +2060,10 @@ where `secureSocket` has the same API as `pair.cleartext`.
20552060
<!-- YAML
20562061
added: v0.3.2
20572062
changes:
2063+
- version: REPLACEME
2064+
pr-url: https://github.com/nodejs/node/pull/53329
2065+
description: The `clientCertEngine` option depends on custom engine
2066+
support in OpenSSL which is deprecated in OpenSSL 3.
20582067
- version:
20592068
- v20.4.0
20602069
- v18.19.0
@@ -2102,7 +2111,7 @@ changes:
21022111
protocols, an error will be thrown. This option cannot be used with the
21032112
`ALPNProtocols` option, and setting both options will throw an error.
21042113
* `clientCertEngine` {string} Name of an OpenSSL engine which can provide the
2105-
client certificate.
2114+
client certificate. **Deprecated.**
21062115
* `enableTrace` {boolean} If `true`, [`tls.TLSSocket.enableTrace()`][] will be
21072116
called on new connections. Tracing can be enabled after the secure
21082117
connection is established, but this option must be used to trace the secure

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL