2012-02-27 20:09:35 +01:00
|
|
|
# TLS (SSL)
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-03-03 00:14:03 +01:00
|
|
|
Stability: 3 - Stable
|
|
|
|
|
2010-12-08 22:22:12 +01:00
|
|
|
Use `require('tls')` to access this module.
|
|
|
|
|
|
|
|
The `tls` module uses OpenSSL to provide Transport Layer Security and/or
|
|
|
|
Secure Socket Layer: encrypted stream communication.
|
|
|
|
|
|
|
|
TLS/SSL is a public/private key infrastructure. Each client and each
|
|
|
|
server must have a private key. A private key is created like this
|
|
|
|
|
|
|
|
openssl genrsa -out ryans-key.pem 1024
|
|
|
|
|
|
|
|
All severs and some clients need to have a certificate. Certificates are public
|
|
|
|
keys signed by a Certificate Authority or self-signed. The first step to
|
|
|
|
getting a certificate is to create a "Certificate Signing Request" (CSR)
|
|
|
|
file. This is done with:
|
|
|
|
|
|
|
|
openssl req -new -key ryans-key.pem -out ryans-csr.pem
|
|
|
|
|
|
|
|
To create a self-signed certificate with the CSR, do this:
|
|
|
|
|
|
|
|
openssl x509 -req -in ryans-csr.pem -signkey ryans-key.pem -out ryans-cert.pem
|
|
|
|
|
|
|
|
Alternatively you can send the CSR to a Certificate Authority for signing.
|
|
|
|
|
|
|
|
(TODO: docs on creating a CA, for now interested users should just look at
|
|
|
|
`test/fixtures/keys/Makefile` in the Node source code)
|
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## Client-initiated renegotiation attack mitigation
|
|
|
|
|
|
|
|
<!-- type=misc -->
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-02-15 19:26:43 +01:00
|
|
|
The TLS protocol lets the client renegotiate certain aspects of the TLS session.
|
|
|
|
Unfortunately, session renegotiation requires a disproportional amount of
|
|
|
|
server-side resources, which makes it a potential vector for denial-of-service
|
|
|
|
attacks.
|
|
|
|
|
|
|
|
To mitigate this, renegotiations are limited to three times every 10 minutes. An
|
|
|
|
error is emitted on the [CleartextStream](#tls.CleartextStream) instance when
|
|
|
|
the threshold is exceeded. The limits are configurable:
|
|
|
|
|
|
|
|
- `tls.CLIENT_RENEG_LIMIT`: renegotiation limit, default is 3.
|
|
|
|
|
|
|
|
- `tls.CLIENT_RENEG_WINDOW`: renegotiation window in seconds, default is
|
|
|
|
10 minutes.
|
|
|
|
|
|
|
|
Don't change the defaults unless you know what you are doing.
|
|
|
|
|
|
|
|
To test your server, connect to it with `openssl s_client -connect address:port`
|
|
|
|
and tap `R<CR>` (that's the letter `R` followed by a carriage return) a few
|
|
|
|
times.
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## NPN and SNI
|
|
|
|
|
|
|
|
<!-- type=misc -->
|
2012-02-17 23:58:42 +01:00
|
|
|
|
|
|
|
NPN (Next Protocol Negotiation) and SNI (Server Name Indication) are TLS
|
|
|
|
handshake extensions allowing you:
|
|
|
|
|
|
|
|
* NPN - to use one TLS server for multiple protocols (HTTP, SPDY)
|
|
|
|
* SNI - to use one TLS server for multiple hostnames with different SSL
|
|
|
|
certificates.
|
|
|
|
|
|
|
|
|
|
|
|
## tls.createServer(options, [secureConnectionListener])
|
2011-10-15 18:26:38 +02:00
|
|
|
|
|
|
|
Creates a new [tls.Server](#tls.Server).
|
|
|
|
The `connectionListener` argument is automatically set as a listener for the
|
|
|
|
[secureConnection](#event_secureConnection_) event.
|
|
|
|
The `options` object has these possibilities:
|
|
|
|
|
|
|
|
- `key`: A string or `Buffer` containing the private key of the server in
|
|
|
|
PEM format. (Required)
|
|
|
|
|
2011-10-26 19:34:56 +02:00
|
|
|
- `passphrase`: A string of passphrase for the private key.
|
|
|
|
|
2011-10-15 18:26:38 +02:00
|
|
|
- `cert`: A string or `Buffer` containing the certificate key of the server in
|
|
|
|
PEM format. (Required)
|
|
|
|
|
|
|
|
- `ca`: An array of strings or `Buffer`s of trusted certificates. If this is
|
|
|
|
omitted several well known "root" CAs will be used, like VeriSign.
|
|
|
|
These are used to authorize connections.
|
|
|
|
|
2012-02-10 06:58:58 +01:00
|
|
|
- `crl` : Either a string or list of strings of PEM encoded CRLs (Certificate
|
|
|
|
Revocation List)
|
|
|
|
|
2012-02-09 17:14:39 +01:00
|
|
|
- `ciphers`: A string describing the ciphers to use or exclude. Consult
|
|
|
|
<http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT> for
|
|
|
|
details on the format.
|
2012-02-10 06:58:58 +01:00
|
|
|
To mitigate [BEAST attacks]
|
|
|
|
(http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html),
|
|
|
|
it is recommended that you use this option in conjunction with the
|
|
|
|
`honorCipherOrder` option described below to prioritize the RC4 algorithm,
|
|
|
|
since it is a non-CBC cipher. A recommended cipher list follows:
|
|
|
|
`ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM`
|
|
|
|
|
|
|
|
- `honorCipherOrder` :
|
|
|
|
When choosing a cipher, use the server's preferences instead of the client
|
|
|
|
preferences.
|
|
|
|
Note that if SSLv2 is used, the server will send its list of preferences
|
|
|
|
to the client, and the client chooses the cipher.
|
|
|
|
Although, this option is disabled by default, it is *recommended* that you
|
|
|
|
use this option in conjunction with the `ciphers` option to mitigate
|
|
|
|
BEAST attacks.
|
2012-02-09 17:14:39 +01:00
|
|
|
|
2011-10-15 18:26:38 +02:00
|
|
|
- `requestCert`: If `true` the server will request a certificate from
|
|
|
|
clients that connect and attempt to verify that certificate. Default:
|
|
|
|
`false`.
|
|
|
|
|
|
|
|
- `rejectUnauthorized`: If `true` the server will reject any connection
|
|
|
|
which is not authorized with the list of supplied CAs. This option only
|
|
|
|
has an effect if `requestCert` is `true`. Default: `false`.
|
|
|
|
|
|
|
|
- `NPNProtocols`: An array or `Buffer` of possible NPN protocols. (Protocols
|
|
|
|
should be ordered by their priority).
|
|
|
|
|
|
|
|
- `SNICallback`: A function that will be called if client supports SNI TLS
|
|
|
|
extension. Only one argument will be passed to it: `servername`. And
|
|
|
|
`SNICallback` should return SecureContext instance.
|
|
|
|
(You can use `crypto.createCredentials(...).context` to get proper
|
|
|
|
SecureContext). If `SNICallback` wasn't provided - default callback with
|
|
|
|
high-level API will be used (see below).
|
|
|
|
|
|
|
|
- `sessionIdContext`: A string containing a opaque identifier for session
|
|
|
|
resumption. If `requestCert` is `true`, the default is MD5 hash value
|
|
|
|
generated from command-line. Otherwise, the default is not provided.
|
|
|
|
|
|
|
|
Here is a simple example echo server:
|
|
|
|
|
|
|
|
var tls = require('tls');
|
|
|
|
var fs = require('fs');
|
|
|
|
|
|
|
|
var options = {
|
|
|
|
key: fs.readFileSync('server-key.pem'),
|
|
|
|
cert: fs.readFileSync('server-cert.pem'),
|
2011-10-16 09:31:41 +02:00
|
|
|
|
|
|
|
// This is necessary only if using the client certificate authentication.
|
2011-10-15 18:26:38 +02:00
|
|
|
requestCert: true,
|
2011-10-16 09:31:41 +02:00
|
|
|
|
|
|
|
// This is necessary only if the client uses the self-signed certificate.
|
2011-10-15 18:26:38 +02:00
|
|
|
ca: [ fs.readFileSync('client-cert.pem') ]
|
|
|
|
};
|
|
|
|
|
2011-10-16 09:31:41 +02:00
|
|
|
var server = tls.createServer(options, function(cleartextStream) {
|
2011-10-15 18:26:38 +02:00
|
|
|
console.log('server connected',
|
2011-10-16 09:31:41 +02:00
|
|
|
cleartextStream.authorized ? 'authorized' : 'unauthorized');
|
|
|
|
cleartextStream.write("welcome!\n");
|
|
|
|
cleartextStream.setEncoding('utf8');
|
|
|
|
cleartextStream.pipe(cleartextStream);
|
2011-10-15 18:26:38 +02:00
|
|
|
});
|
|
|
|
server.listen(8000, function() {
|
|
|
|
console.log('server bound');
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
You can test this server by connecting to it with `openssl s_client`:
|
|
|
|
|
|
|
|
|
|
|
|
openssl s_client -connect 127.0.0.1:8000
|
|
|
|
|
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## tls.connect(options, [secureConnectListener])
|
|
|
|
## tls.connect(port, [host], [options], [secureConnectListener])
|
2010-12-11 11:26:48 +01:00
|
|
|
|
2011-11-02 01:27:50 +01:00
|
|
|
Creates a new client connection to the given `port` and `host` (old API) or
|
|
|
|
`options.port` and `options.host`. (If `host` is omitted, it defaults to
|
|
|
|
`localhost`.) `options` should be an object which specifies:
|
|
|
|
|
|
|
|
- `host`: Host the client should connect to
|
|
|
|
|
|
|
|
- `port`: Port the client should connect to
|
2010-12-11 11:26:48 +01:00
|
|
|
|
2012-01-09 02:28:49 +01:00
|
|
|
- `socket`: Establish secure connection on a given socket rather than
|
|
|
|
creating a new socket. If this option is specified, `host` and `port`
|
|
|
|
are ignored.
|
|
|
|
|
2011-10-16 09:31:41 +02:00
|
|
|
- `key`: A string or `Buffer` containing the private key of the client in
|
2011-10-26 19:34:56 +02:00
|
|
|
PEM format.
|
|
|
|
|
|
|
|
- `passphrase`: A string of passphrase for the private key.
|
2010-12-11 11:26:48 +01:00
|
|
|
|
2011-10-16 09:31:41 +02:00
|
|
|
- `cert`: A string or `Buffer` containing the certificate key of the client in
|
2010-12-11 11:26:48 +01:00
|
|
|
PEM format.
|
|
|
|
|
|
|
|
- `ca`: An array of strings or `Buffer`s of trusted certificates. If this is
|
|
|
|
omitted several well known "root" CAs will be used, like VeriSign.
|
|
|
|
These are used to authorize connections.
|
|
|
|
|
2011-12-07 14:47:06 +01:00
|
|
|
- `rejectUnauthorized`: If `true`, the server certificate is verified against
|
|
|
|
the list of supplied CAs. An `'error'` event is emitted if verification
|
|
|
|
fails. Default: `false`.
|
|
|
|
|
2011-07-30 16:03:05 +02:00
|
|
|
- `NPNProtocols`: An array of string or `Buffer` containing supported NPN
|
2011-10-16 09:31:41 +02:00
|
|
|
protocols. `Buffer` should have following format: `0x05hello0x05world`,
|
|
|
|
where first byte is next protocol name's length. (Passing array should
|
2011-11-26 03:26:11 +01:00
|
|
|
usually be much simpler: `['hello', 'world']`.)
|
2011-07-30 16:03:05 +02:00
|
|
|
|
|
|
|
- `servername`: Servername for SNI (Server Name Indication) TLS extension.
|
|
|
|
|
2011-10-15 12:27:21 +02:00
|
|
|
The `secureConnectListener` parameter will be added as a listener for the
|
|
|
|
['secureConnect'](#event_secureConnect_) event.
|
2010-12-11 11:26:48 +01:00
|
|
|
|
2011-10-15 12:27:21 +02:00
|
|
|
`tls.connect()` returns a [CleartextStream](#tls.CleartextStream) object.
|
2010-12-11 11:26:48 +01:00
|
|
|
|
2011-10-15 18:26:38 +02:00
|
|
|
Here is an example of a client of echo server as described previously:
|
|
|
|
|
|
|
|
var tls = require('tls');
|
|
|
|
var fs = require('fs');
|
|
|
|
|
|
|
|
var options = {
|
2011-10-16 09:31:41 +02:00
|
|
|
// These are necessary only if using the client certificate authentication
|
2011-10-15 18:26:38 +02:00
|
|
|
key: fs.readFileSync('client-key.pem'),
|
|
|
|
cert: fs.readFileSync('client-cert.pem'),
|
2011-10-16 09:31:41 +02:00
|
|
|
|
|
|
|
// This is necessary only if the server uses the self-signed certificate
|
2011-10-15 18:26:38 +02:00
|
|
|
ca: [ fs.readFileSync('server-cert.pem') ]
|
|
|
|
};
|
|
|
|
|
2011-10-16 09:31:41 +02:00
|
|
|
var cleartextStream = tls.connect(8000, options, function() {
|
2011-10-15 18:26:38 +02:00
|
|
|
console.log('client connected',
|
2011-10-16 09:31:41 +02:00
|
|
|
cleartextStream.authorized ? 'authorized' : 'unauthorized');
|
|
|
|
process.stdin.pipe(cleartextStream);
|
|
|
|
process.stdin.resume();
|
|
|
|
});
|
|
|
|
cleartextStream.setEncoding('utf8');
|
|
|
|
cleartextStream.on('data', function(data) {
|
|
|
|
console.log(data);
|
2011-10-15 18:26:38 +02:00
|
|
|
});
|
2011-10-16 09:31:41 +02:00
|
|
|
cleartextStream.on('end', function() {
|
|
|
|
server.close();
|
2011-10-15 18:26:38 +02:00
|
|
|
});
|
|
|
|
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
## tls.createSecurePair([credentials], [isServer], [requestCert], [rejectUnauthorized])
|
2011-03-29 18:58:50 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
Creates a new secure pair object with two streams, one of which reads/writes
|
|
|
|
encrypted data, and one reads/writes cleartext data.
|
|
|
|
Generally the encrypted one is piped to/from an incoming encrypted data stream,
|
|
|
|
and the cleartext one is used as a replacement for the initial encrypted stream.
|
2011-03-29 18:58:50 +02:00
|
|
|
|
2011-08-03 04:17:16 +02:00
|
|
|
- `credentials`: A credentials object from crypto.createCredentials( ... )
|
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
- `isServer`: A boolean indicating whether this tls connection should be
|
|
|
|
opened as a server or a client.
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
- `requestCert`: A boolean indicating whether a server should request a
|
|
|
|
certificate from a connecting client. Only applies to server connections.
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
- `rejectUnauthorized`: A boolean indicating whether a server should
|
|
|
|
automatically reject clients with invalid certificates. Only applies to
|
|
|
|
servers with `requestCert` enabled.
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
`tls.createSecurePair()` returns a SecurePair object with
|
|
|
|
[cleartext](#tls.CleartextStream) and `encrypted` stream properties.
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## Class: SecurePair
|
|
|
|
|
|
|
|
Returned by tls.createSecurePair.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### Event: 'secure'
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
The event is emitted from the SecurePair once the pair has successfully
|
|
|
|
established a secure connection.
|
2011-08-03 04:17:16 +02:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
Similarly to the checking for the server 'secureConnection' event,
|
|
|
|
pair.cleartext.authorized should be checked to confirm whether the certificate
|
|
|
|
used properly authorized.
|
2011-03-29 18:58:50 +02:00
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## Class: tls.Server
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
This class is a subclass of `net.Server` and has the same methods on it.
|
|
|
|
Instead of accepting just raw TCP connections, this accepts encrypted
|
|
|
|
connections using TLS or SSL.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### Event: 'secureConnection'
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
`function (cleartextStream) {}`
|
|
|
|
|
|
|
|
This event is emitted after a new connection has been successfully
|
2011-08-11 10:13:13 +02:00
|
|
|
handshaked. The argument is a instance of
|
|
|
|
[CleartextStream](#tls.CleartextStream). It has all the common stream methods
|
|
|
|
and events.
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
`cleartextStream.authorized` is a boolean value which indicates if the
|
2011-02-25 01:36:43 +01:00
|
|
|
client has verified by one of the supplied certificate authorities for the
|
2010-12-08 22:22:12 +01:00
|
|
|
server. If `cleartextStream.authorized` is false, then
|
|
|
|
`cleartextStream.authorizationError` is set to describe how authorization
|
|
|
|
failed. Implied but worth mentioning: depending on the settings of the TLS
|
2011-07-30 16:03:05 +02:00
|
|
|
server, you unauthorized connections may be accepted.
|
|
|
|
`cleartextStream.npnProtocol` is a string containing selected NPN protocol.
|
|
|
|
`cleartextStream.servername` is a string containing servername requested with
|
|
|
|
SNI.
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### Event: 'clientError'
|
2011-12-17 18:09:16 +01:00
|
|
|
|
|
|
|
`function (exception) { }`
|
|
|
|
|
|
|
|
When a client connection emits an 'error' event before secure connection is
|
|
|
|
established - it will be forwarded here.
|
|
|
|
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.listen(port, [host], [callback])
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
Begin accepting connections on the specified `port` and `host`. If the
|
|
|
|
`host` is omitted, the server will accept connections directed to any
|
|
|
|
IPv4 address (`INADDR_ANY`).
|
|
|
|
|
|
|
|
This function is asynchronous. The last parameter `callback` will be called
|
|
|
|
when the server has been bound.
|
|
|
|
|
|
|
|
See `net.Server` for more information.
|
|
|
|
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.close()
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
Stops the server from accepting new connections. This function is
|
|
|
|
asynchronous, the server is finally closed when the server emits a `'close'`
|
|
|
|
event.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.address()
|
2011-10-26 14:12:23 +02:00
|
|
|
|
|
|
|
Returns the bound address and port of the server as reported by the operating
|
|
|
|
system.
|
|
|
|
See [net.Server.address()](net.html#server.address) for more information.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.addContext(hostname, credentials)
|
2011-07-30 16:03:05 +02:00
|
|
|
|
|
|
|
Add secure context that will be used if client request's SNI hostname is
|
|
|
|
matching passed `hostname` (wildcards can be used). `credentials` can contain
|
|
|
|
`key`, `cert` and `ca`.
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.maxConnections
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2011-08-11 10:13:13 +02:00
|
|
|
Set this property to reject connections when the server's connection count
|
|
|
|
gets high.
|
2010-12-08 22:22:12 +01:00
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### server.connections
|
2010-12-08 22:22:12 +01:00
|
|
|
|
|
|
|
The number of concurrent connections on the server.
|
2011-08-11 10:13:13 +02:00
|
|
|
|
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
## Class: tls.CleartextStream
|
2011-08-11 10:13:13 +02:00
|
|
|
|
|
|
|
This is a stream on top of the *Encrypted* stream that makes it possible to
|
|
|
|
read/write an encrypted data as a cleartext data.
|
|
|
|
|
2012-02-27 20:18:10 +01:00
|
|
|
This instance implements a duplex [Stream](stream.html) interfaces.
|
2011-08-11 10:13:13 +02:00
|
|
|
It has all the common stream methods and events.
|
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
A ClearTextStream is the `clear` member of a SecurePair object.
|
2011-10-15 12:27:21 +02:00
|
|
|
|
2012-02-27 20:09:35 +01:00
|
|
|
### Event: 'secureConnect'
|
2011-10-15 12:27:21 +02:00
|
|
|
|
|
|
|
This event is emitted after a new connection has been successfully handshaked.
|
|
|
|
The listener will be called no matter if the server's certificate was
|
|
|
|
authorized or not. It is up to the user to test `cleartextStream.authorized`
|
|
|
|
to see if the server certificate was signed by one of the specified CAs.
|
|
|
|
If `cleartextStream.authorized === false` then the error can be found in
|
|
|
|
`cleartextStream.authorizationError`. Also if NPN was used - you can check
|
|
|
|
`cleartextStream.npnProtocol` for negotiated protocol.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.authorized
|
2011-08-11 10:13:13 +02:00
|
|
|
|
|
|
|
A boolean that is `true` if the peer certificate was signed by one of the
|
|
|
|
specified CAs, otherwise `false`
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.authorizationError
|
2011-08-11 10:13:13 +02:00
|
|
|
|
|
|
|
The reason why the peer's certificate has not been verified. This property
|
|
|
|
becomes available only when `cleartextStream.authorized === false`.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.getPeerCertificate()
|
2011-08-11 10:13:13 +02:00
|
|
|
|
2011-11-26 03:26:11 +01:00
|
|
|
Returns an object representing the peer's certificate. The returned object has
|
2011-08-11 10:13:13 +02:00
|
|
|
some properties corresponding to the field of the certificate.
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
{ subject:
|
|
|
|
{ C: 'UK',
|
|
|
|
ST: 'Acknack Ltd',
|
|
|
|
L: 'Rhys Jones',
|
|
|
|
O: 'node.js',
|
|
|
|
OU: 'Test TLS Certificate',
|
|
|
|
CN: 'localhost' },
|
|
|
|
issuer:
|
|
|
|
{ C: 'UK',
|
|
|
|
ST: 'Acknack Ltd',
|
|
|
|
L: 'Rhys Jones',
|
|
|
|
O: 'node.js',
|
|
|
|
OU: 'Test TLS Certificate',
|
|
|
|
CN: 'localhost' },
|
|
|
|
valid_from: 'Nov 11 09:52:22 2009 GMT',
|
|
|
|
valid_to: 'Nov 6 09:52:22 2029 GMT',
|
|
|
|
fingerprint: '2A:7A:C2:DD:E5:F9:CC:53:72:35:99:7A:02:5A:71:38:52:EC:8A:DF' }
|
|
|
|
|
|
|
|
If the peer does not provide a certificate, it returns `null` or an empty
|
|
|
|
object.
|
2011-10-26 14:12:23 +02:00
|
|
|
|
2012-03-23 05:04:10 +01:00
|
|
|
### cleartextStream.getCipher()
|
|
|
|
Returns an object representing the cipher name and the SSL/TLS
|
|
|
|
protocol version of the current connection.
|
|
|
|
|
|
|
|
Example:
|
|
|
|
{ name: 'AES256-SHA', version: 'TLSv1/SSLv3' }
|
|
|
|
|
|
|
|
See SSL_CIPHER_get_name() and SSL_CIPHER_get_version() in
|
|
|
|
http://www.openssl.org/docs/ssl/ssl.html#DEALING_WITH_CIPHERS for more
|
|
|
|
information.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.address()
|
2011-10-26 14:12:23 +02:00
|
|
|
|
|
|
|
Returns the bound address and port of the underlying socket as reported by the
|
|
|
|
operating system. Returns an object with two properties, e.g.
|
|
|
|
`{"address":"192.168.57.1", "port":62053}`
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.remoteAddress
|
2011-10-26 14:12:23 +02:00
|
|
|
|
|
|
|
The string representation of the remote IP address. For example,
|
|
|
|
`'74.125.127.100'` or `'2001:4860:a005::68'`.
|
|
|
|
|
2012-02-17 23:58:42 +01:00
|
|
|
### cleartextStream.remotePort
|
2011-10-26 14:12:23 +02:00
|
|
|
|
|
|
|
The numeric representation of the remote port. For example, `443`.
|