Clever Geek Handbook

How to disable tls 1.0 and only use tls 1.1 using nodejs

I want to disable TLS v1.0 and only use TLS 1.1 and above.

In nodejs I am using a module https

, how do I set https options?

I have read api doc node api tls , but I still don't know how to install this.

I think it depends on secureProtocol

and cipher

, but I just don't know how to set the value.

My node version is 0.10.36 and openssl version is 0.9.8j.

+3


source to share


3 answers


TLS 1.0 should no longer be used. This works to disable TLS 1.0 in node.js:

https.createServer({
    secureOptions: require('constants').SSL_OP_NO_TLSv1,
    pfx: fs.readFileSync(path.resolve(pathToCert))
}, app).listen(443);


You can check it with this tool: ssllabs

+3


source


The use of the constant module is undocumented. The best way to disable TLS v1.0 would be to use constants from the crypto module. See the documentation on the Node.js website for reference.

The solution then becomes this:



const { constants } = require('crypto')
https.createServer({
    secureOptions: constants.SSL_OP_NO_TLSv1,
    pfx: fs.readFileSync(path.resolve(pathToCert))
}, app).listen(443)
0


source


It will be helpful if someone is using MEANjs

using

secureProtocol: 'TLSv1_2_server_method',

instead

secureProtocol: 'TLSv1_method',

config / lib / socket.io.js file location

Works without problems. enter image description here

0


source






More articles:


All Articles