String containing the selected ALPN protocol. When ALPN has no selected protocol, tlsSocket.alpnProtocol equals false.
The reason why the peer's certificate has not been verified. This property becomes available only when tlsSocket.authorized === false.
A boolean that is true if the peer certificate was signed by one of the specified CAs, otherwise false.
Static boolean value, always true. May be used to distinguish TLS sockets from regular ones.
Disables TLS renegotiation for this TLSSocket instance. Once called, attempts to renegotiate will trigger an 'error' event on the TLSSocket.
When enabled, TLS packet trace information is written to stderr. This can be
used to debug TLS connection problems.
Note: The format of the output is identical to the output of openssl s_client
-trace or openssl s_server -trace. While it is produced by OpenSSL's
SSL_trace() function, the format is undocumented, can change without notice,
and should not be relied on.
number of bytes to retrieve from keying material
an application specific label, typically this will be a value from the IANA Exporter Label Registry.
optionally provide a context.
Returns an object representing the local certificate. The returned object has some properties corresponding to the fields of the certificate.
See tls.TLSSocket.getPeerCertificate() for an example of the certificate structure.
If there is no local certificate, an empty object will be returned. If the socket has been destroyed, null will be returned.
Returns an object representing the cipher name and the SSL/TLS protocol version of the current connection.
Returns an object representing the cipher name and the SSL/TLS protocol version of the current connection.
Returns an object representing the type, name, and size of parameter of an ephemeral key exchange in Perfect Forward Secrecy on a client connection. It returns an empty object when the key exchange is not ephemeral. As this is only supported on a client socket; null is returned if called on a server socket. The supported types are 'DH' and 'ECDH'. The name property is available only when type is 'ECDH'.
For example: { type: 'ECDH', name: 'prime256v1', size: 256 }.
Returns the latest Finished message that has been sent to the socket as part of a SSL/TLS handshake, or undefined if no Finished message has been sent yet.
As the Finished messages are message digests of the complete handshake (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can be used for external authentication procedures when the authentication provided by SSL/TLS is not desired or is not enough.
Corresponds to the SSL_get_finished routine in OpenSSL and may be used to implement the tls-unique channel binding from RFC 5929.
Returns an object representing the peer's certificate. The returned object has some properties corresponding to the field of the certificate. If detailed argument is true the full chain with issuer property will be returned, if false only the top certificate without issuer property. If the peer does not provide a certificate, it returns null or an empty object.
If true; the full chain with issuer property will be returned.
An object representing the peer's certificate.
Returns the latest Finished message that is expected or has actually been received from the socket as part of a SSL/TLS handshake, or undefined if there is no Finished message so far.
As the Finished messages are message digests of the complete handshake (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can be used for external authentication procedures when the authentication provided by SSL/TLS is not desired or is not enough.
Corresponds to the SSL_get_peer_finished routine in OpenSSL and may be used to implement the tls-unique channel binding from RFC 5929.
Returns a string containing the negotiated SSL/TLS protocol version of the current connection.
The value 'unknown' will be returned for connected sockets that have not completed the handshaking process.
The value null will be returned for server sockets or disconnected client sockets.
See https://www.openssl.org/docs/man1.0.2/ssl/SSL_get_version.html for more information.
negotiated SSL/TLS protocol version of the current connection
Could be used to speed up handshake establishment when reconnecting to the server.
ASN.1 encoded TLS session or undefined if none was negotiated.
Returns a list of signature algorithms shared between the server and the client in the order of decreasing preference.
NOTE: Works only with client TLS sockets. Useful only for debugging, for session reuse provide session option to tls.connect().
TLS session ticket or undefined if none was negotiated.
Returns true if the session was reused, false otherwise.
Initiate TLS renegotiation process.
NOTE: Can be used to request peer's certificate after the secure connection has been established. ANOTHER NOTE: When running as the server, socket will be destroyed with an error after handshakeTimeout timeout.
The options may contain the following fields: rejectUnauthorized, requestCert (See tls.createServer() for details).
callback(err) will be executed with null as err, once the renegotiation is successfully completed.
undefined when socket is destroy, false if negotiaion can't be initiated.
Set maximum TLS fragment size (default and maximum value is: 16384, minimum is: 512). Smaller fragment size decreases buffering latency on the client: large fragments are buffered by the TLS layer until the entire fragment is received and its integrity is verified; large fragments can span multiple roundtrips, and their processing can be delayed due to packet loss or reordering. However, smaller fragments add extra TLS framing bytes and CPU overhead, which may decrease overall server throughput.
TLS fragment size (default and maximum value is: 16384, minimum is: 512).
Returns true on success, false otherwise.
A utility method for creating Readable Streams out of iterators.
Generated using TypeDoc
Construct a new tls.TLSSocket object from an existing TCP socket.