1 | declare module "tls" {
|
2 | import * as crypto from "crypto";
|
3 | import * as dns from "dns";
|
4 | import * as net from "net";
|
5 | import * as stream from "stream";
|
6 |
|
7 | const CLIENT_RENEG_LIMIT: number;
|
8 | const CLIENT_RENEG_WINDOW: number;
|
9 |
|
10 | interface Certificate {
|
11 | /**
|
12 | * Country code.
|
13 | */
|
14 | C: string;
|
15 | /**
|
16 | * Street.
|
17 | */
|
18 | ST: string;
|
19 | /**
|
20 | * Locality.
|
21 | */
|
22 | L: string;
|
23 | /**
|
24 | * Organization.
|
25 | */
|
26 | O: string;
|
27 | /**
|
28 | * Organizational unit.
|
29 | */
|
30 | OU: string;
|
31 | /**
|
32 | * Common name.
|
33 | */
|
34 | CN: string;
|
35 | }
|
36 |
|
37 | interface PeerCertificate {
|
38 | subject: Certificate;
|
39 | issuer: Certificate;
|
40 | subjectaltname: string;
|
41 | infoAccess: { [index: string]: string[] | undefined };
|
42 | modulus: string;
|
43 | exponent: string;
|
44 | valid_from: string;
|
45 | valid_to: string;
|
46 | fingerprint: string;
|
47 | ext_key_usage: string[];
|
48 | serialNumber: string;
|
49 | raw: Buffer;
|
50 | }
|
51 |
|
52 | interface DetailedPeerCertificate extends PeerCertificate {
|
53 | issuerCertificate: DetailedPeerCertificate;
|
54 | }
|
55 |
|
56 | interface CipherNameAndProtocol {
|
57 | /**
|
58 | * The cipher name.
|
59 | */
|
60 | name: string;
|
61 | /**
|
62 | * SSL/TLS protocol version.
|
63 | */
|
64 | version: string;
|
65 | }
|
66 |
|
67 | interface EphemeralKeyInfo {
|
68 | /**
|
69 | * The supported types are 'DH' and 'ECDH'.
|
70 | */
|
71 | type: string;
|
72 | /**
|
73 | * The name property is available only when type is 'ECDH'.
|
74 | */
|
75 | name?: string;
|
76 | /**
|
77 | * The size of parameter of an ephemeral key exchange.
|
78 | */
|
79 | size: number;
|
80 | }
|
81 |
|
82 | interface KeyObject {
|
83 | /**
|
84 | * Private keys in PEM format.
|
85 | */
|
86 | pem: string | Buffer;
|
87 | /**
|
88 | * Optional passphrase.
|
89 | */
|
90 | passphrase?: string;
|
91 | }
|
92 |
|
93 | interface PxfObject {
|
94 | /**
|
95 | * PFX or PKCS12 encoded private key and certificate chain.
|
96 | */
|
97 | buf: string | Buffer;
|
98 | /**
|
99 | * Optional passphrase.
|
100 | */
|
101 | passphrase?: string;
|
102 | }
|
103 |
|
104 | interface TLSSocketOptions extends SecureContextOptions, CommonConnectionOptions {
|
105 | /**
|
106 | * If true the TLS socket will be instantiated in server-mode.
|
107 | * Defaults to false.
|
108 | */
|
109 | isServer?: boolean;
|
110 | /**
|
111 | * An optional net.Server instance.
|
112 | */
|
113 | server?: net.Server;
|
114 |
|
115 | /**
|
116 | * An optional Buffer instance containing a TLS session.
|
117 | */
|
118 | session?: Buffer;
|
119 | /**
|
120 | * If true, specifies that the OCSP status request extension will be
|
121 | * added to the client hello and an 'OCSPResponse' event will be
|
122 | * emitted on the socket before establishing a secure communication
|
123 | */
|
124 | requestOCSP?: boolean;
|
125 | }
|
126 |
|
127 | class TLSSocket extends net.Socket {
|
128 | /**
|
129 | * Construct a new tls.TLSSocket object from an existing TCP socket.
|
130 | */
|
131 | constructor(socket: net.Socket, options?: TLSSocketOptions);
|
132 |
|
133 | /**
|
134 | * A boolean that is true if the peer certificate was signed by one of the specified CAs, otherwise false.
|
135 | */
|
136 | authorized: boolean;
|
137 | /**
|
138 | * The reason why the peer's certificate has not been verified.
|
139 | * This property becomes available only when tlsSocket.authorized === false.
|
140 | */
|
141 | authorizationError: Error;
|
142 | /**
|
143 | * Static boolean value, always true.
|
144 | * May be used to distinguish TLS sockets from regular ones.
|
145 | */
|
146 | encrypted: boolean;
|
147 |
|
148 | /**
|
149 | * String containing the selected ALPN protocol.
|
150 | * When ALPN has no selected protocol, tlsSocket.alpnProtocol equals false.
|
151 | */
|
152 | alpnProtocol?: string;
|
153 |
|
154 | /**
|
155 | * Returns an object representing the local certificate. The returned
|
156 | * object has some properties corresponding to the fields of the
|
157 | * certificate.
|
158 | *
|
159 | * See tls.TLSSocket.getPeerCertificate() for an example of the
|
160 | * certificate structure.
|
161 | *
|
162 | * If there is no local certificate, an empty object will be returned.
|
163 | * If the socket has been destroyed, null will be returned.
|
164 | */
|
165 | getCertificate(): PeerCertificate | object | null;
|
166 | /**
|
167 | * Returns an object representing the cipher name and the SSL/TLS protocol version of the current connection.
|
168 | * @returns Returns an object representing the cipher name
|
169 | * and the SSL/TLS protocol version of the current connection.
|
170 | */
|
171 | getCipher(): CipherNameAndProtocol;
|
172 | /**
|
173 | * Returns an object representing the type, name, and size of parameter
|
174 | * of an ephemeral key exchange in Perfect Forward Secrecy on a client
|
175 | * connection. It returns an empty object when the key exchange is not
|
176 | * ephemeral. As this is only supported on a client socket; null is
|
177 | * returned if called on a server socket. The supported types are 'DH'
|
178 | * and 'ECDH'. The name property is available only when type is 'ECDH'.
|
179 | *
|
180 | * For example: { type: 'ECDH', name: 'prime256v1', size: 256 }.
|
181 | */
|
182 | getEphemeralKeyInfo(): EphemeralKeyInfo | object | null;
|
183 | /**
|
184 | * Returns the latest Finished message that has
|
185 | * been sent to the socket as part of a SSL/TLS handshake, or undefined
|
186 | * if no Finished message has been sent yet.
|
187 | *
|
188 | * As the Finished messages are message digests of the complete
|
189 | * handshake (with a total of 192 bits for TLS 1.0 and more for SSL
|
190 | * 3.0), they can be used for external authentication procedures when
|
191 | * the authentication provided by SSL/TLS is not desired or is not
|
192 | * enough.
|
193 | *
|
194 | * Corresponds to the SSL_get_finished routine in OpenSSL and may be
|
195 | * used to implement the tls-unique channel binding from RFC 5929.
|
196 | */
|
197 | getFinished(): Buffer | undefined;
|
198 | /**
|
199 | * Returns an object representing the peer's certificate.
|
200 | * The returned object has some properties corresponding to the field of the certificate.
|
201 | * If detailed argument is true the full chain with issuer property will be returned,
|
202 | * if false only the top certificate without issuer property.
|
203 | * If the peer does not provide a certificate, it returns null or an empty object.
|
204 | * @param detailed - If true; the full chain with issuer property will be returned.
|
205 | * @returns An object representing the peer's certificate.
|
206 | */
|
207 | getPeerCertificate(detailed: true): DetailedPeerCertificate;
|
208 | getPeerCertificate(detailed?: false): PeerCertificate;
|
209 | getPeerCertificate(detailed?: boolean): PeerCertificate | DetailedPeerCertificate;
|
210 | /**
|
211 | * Returns the latest Finished message that is expected or has actually
|
212 | * been received from the socket as part of a SSL/TLS handshake, or
|
213 | * undefined if there is no Finished message so far.
|
214 | *
|
215 | * As the Finished messages are message digests of the complete
|
216 | * handshake (with a total of 192 bits for TLS 1.0 and more for SSL
|
217 | * 3.0), they can be used for external authentication procedures when
|
218 | * the authentication provided by SSL/TLS is not desired or is not
|
219 | * enough.
|
220 | *
|
221 | * Corresponds to the SSL_get_peer_finished routine in OpenSSL and may
|
222 | * be used to implement the tls-unique channel binding from RFC 5929.
|
223 | */
|
224 | getPeerFinished(): Buffer | undefined;
|
225 | /**
|
226 | * Returns a string containing the negotiated SSL/TLS protocol version of the current connection.
|
227 | * The value `'unknown'` will be returned for connected sockets that have not completed the handshaking process.
|
228 | * The value `null` will be returned for server sockets or disconnected client sockets.
|
229 | * See https://www.openssl.org/docs/man1.0.2/ssl/SSL_get_version.html for more information.
|
230 | * @returns negotiated SSL/TLS protocol version of the current connection
|
231 | */
|
232 | getProtocol(): string | null;
|
233 | /**
|
234 | * Could be used to speed up handshake establishment when reconnecting to the server.
|
235 | * @returns ASN.1 encoded TLS session or undefined if none was negotiated.
|
236 | */
|
237 | getSession(): Buffer | undefined;
|
238 | /**
|
239 | * Returns a list of signature algorithms shared between the server and
|
240 | * the client in the order of decreasing preference.
|
241 | */
|
242 | getSharedSigalgs(): string[];
|
243 | /**
|
244 | * NOTE: Works only with client TLS sockets.
|
245 | * Useful only for debugging, for session reuse provide session option to tls.connect().
|
246 | * @returns TLS session ticket or undefined if none was negotiated.
|
247 | */
|
248 | getTLSTicket(): Buffer | undefined;
|
249 | /**
|
250 | * Returns true if the session was reused, false otherwise.
|
251 | */
|
252 | isSessionReused(): boolean;
|
253 | /**
|
254 | * Initiate TLS renegotiation process.
|
255 | *
|
256 | * NOTE: Can be used to request peer's certificate after the secure connection has been established.
|
257 | * ANOTHER NOTE: When running as the server, socket will be destroyed with an error after handshakeTimeout timeout.
|
258 | * @param options - The options may contain the following fields: rejectUnauthorized,
|
259 | * requestCert (See tls.createServer() for details).
|
260 | * @param callback - callback(err) will be executed with null as err, once the renegotiation
|
261 | * is successfully completed.
|
262 | * @return `undefined` when socket is destroy, `false` if negotiaion can't be initiated.
|
263 | */
|
264 | renegotiate(options: { rejectUnauthorized?: boolean, requestCert?: boolean }, callback: (err: Error | null) => void): undefined | boolean;
|
265 | /**
|
266 | * Set maximum TLS fragment size (default and maximum value is: 16384, minimum is: 512).
|
267 | * Smaller fragment size decreases buffering latency on the client: large fragments are buffered by
|
268 | * the TLS layer until the entire fragment is received and its integrity is verified;
|
269 | * large fragments can span multiple roundtrips, and their processing can be delayed due to packet
|
270 | * loss or reordering. However, smaller fragments add extra TLS framing bytes and CPU overhead,
|
271 | * which may decrease overall server throughput.
|
272 | * @param size - TLS fragment size (default and maximum value is: 16384, minimum is: 512).
|
273 | * @returns Returns true on success, false otherwise.
|
274 | */
|
275 | setMaxSendFragment(size: number): boolean;
|
276 |
|
277 | /**
|
278 | * Disables TLS renegotiation for this TLSSocket instance. Once called,
|
279 | * attempts to renegotiate will trigger an 'error' event on the
|
280 | * TLSSocket.
|
281 | */
|
282 | disableRenegotiation(): void;
|
283 |
|
284 | /**
|
285 | * When enabled, TLS packet trace information is written to `stderr`. This can be
|
286 | * used to debug TLS connection problems.
|
287 | *
|
288 | * Note: The format of the output is identical to the output of `openssl s_client
|
289 | * -trace` or `openssl s_server -trace`. While it is produced by OpenSSL's
|
290 | * `SSL_trace()` function, the format is undocumented, can change without notice,
|
291 | * and should not be relied on.
|
292 | */
|
293 | enableTrace(): void;
|
294 |
|
295 | addListener(event: string, listener: (...args: any[]) => void): this;
|
296 | addListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
297 | addListener(event: "secureConnect", listener: () => void): this;
|
298 | addListener(event: "session", listener: (session: Buffer) => void): this;
|
299 | addListener(event: "keylog", listener: (line: Buffer) => void): this;
|
300 |
|
301 | emit(event: string | symbol, ...args: any[]): boolean;
|
302 | emit(event: "OCSPResponse", response: Buffer): boolean;
|
303 | emit(event: "secureConnect"): boolean;
|
304 | emit(event: "session", session: Buffer): boolean;
|
305 | emit(event: "keylog", line: Buffer): boolean;
|
306 |
|
307 | on(event: string, listener: (...args: any[]) => void): this;
|
308 | on(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
309 | on(event: "secureConnect", listener: () => void): this;
|
310 | on(event: "session", listener: (session: Buffer) => void): this;
|
311 | on(event: "keylog", listener: (line: Buffer) => void): this;
|
312 |
|
313 | once(event: string, listener: (...args: any[]) => void): this;
|
314 | once(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
315 | once(event: "secureConnect", listener: () => void): this;
|
316 | once(event: "session", listener: (session: Buffer) => void): this;
|
317 | once(event: "keylog", listener: (line: Buffer) => void): this;
|
318 |
|
319 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
320 | prependListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
321 | prependListener(event: "secureConnect", listener: () => void): this;
|
322 | prependListener(event: "session", listener: (session: Buffer) => void): this;
|
323 | prependListener(event: "keylog", listener: (line: Buffer) => void): this;
|
324 |
|
325 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
326 | prependOnceListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
|
327 | prependOnceListener(event: "secureConnect", listener: () => void): this;
|
328 | prependOnceListener(event: "session", listener: (session: Buffer) => void): this;
|
329 | prependOnceListener(event: "keylog", listener: (line: Buffer) => void): this;
|
330 | }
|
331 |
|
332 | interface CommonConnectionOptions {
|
333 | /**
|
334 | * An optional TLS context object from tls.createSecureContext()
|
335 | */
|
336 | secureContext?: SecureContext;
|
337 |
|
338 | /**
|
339 | * When enabled, TLS packet trace information is written to `stderr`. This can be
|
340 | * used to debug TLS connection problems.
|
341 | * @default false
|
342 | */
|
343 | enableTrace?: boolean;
|
344 | /**
|
345 | * If true the server will request a certificate from clients that
|
346 | * connect and attempt to verify that certificate. Defaults to
|
347 | * false.
|
348 | */
|
349 | requestCert?: boolean;
|
350 | /**
|
351 | * An array of strings or a Buffer naming possible ALPN protocols.
|
352 | * (Protocols should be ordered by their priority.)
|
353 | */
|
354 | ALPNProtocols?: string[] | Uint8Array[] | Uint8Array;
|
355 | /**
|
356 | * SNICallback(servername, cb) <Function> A function that will be
|
357 | * called if the client supports SNI TLS extension. Two arguments
|
358 | * will be passed when called: servername and cb. SNICallback should
|
359 | * invoke cb(null, ctx), where ctx is a SecureContext instance.
|
360 | * (tls.createSecureContext(...) can be used to get a proper
|
361 | * SecureContext.) If SNICallback wasn't provided the default callback
|
362 | * with high-level API will be used (see below).
|
363 | */
|
364 | SNICallback?: (servername: string, cb: (err: Error | null, ctx: SecureContext) => void) => void;
|
365 | /**
|
366 | * If true the server will reject any connection which is not
|
367 | * authorized with the list of supplied CAs. This option only has an
|
368 | * effect if requestCert is true.
|
369 | * @default true
|
370 | */
|
371 | rejectUnauthorized?: boolean;
|
372 | }
|
373 |
|
374 | interface TlsOptions extends SecureContextOptions, CommonConnectionOptions {
|
375 | /**
|
376 | * Abort the connection if the SSL/TLS handshake does not finish in the
|
377 | * specified number of milliseconds. A 'tlsClientError' is emitted on
|
378 | * the tls.Server object whenever a handshake times out. Default:
|
379 | * 120000 (120 seconds).
|
380 | */
|
381 | handshakeTimeout?: number;
|
382 | /**
|
383 | * The number of seconds after which a TLS session created by the
|
384 | * server will no longer be resumable. See Session Resumption for more
|
385 | * information. Default: 300.
|
386 | */
|
387 | sessionTimeout?: number;
|
388 | /**
|
389 | * 48-bytes of cryptographically strong pseudo-random data.
|
390 | */
|
391 | ticketKeys?: Buffer;
|
392 | }
|
393 |
|
394 | interface ConnectionOptions extends SecureContextOptions, CommonConnectionOptions {
|
395 | host?: string;
|
396 | port?: number;
|
397 | path?: string; // Creates unix socket connection to path. If this option is specified, `host` and `port` are ignored.
|
398 | socket?: net.Socket; // Establish secure connection on a given socket rather than creating a new socket
|
399 | checkServerIdentity?: typeof checkServerIdentity;
|
400 | servername?: string; // SNI TLS Extension
|
401 | session?: Buffer;
|
402 | minDHSize?: number;
|
403 | lookup?: net.LookupFunction;
|
404 | timeout?: number;
|
405 | }
|
406 |
|
407 | class Server extends net.Server {
|
408 | /**
|
409 | * The server.addContext() method adds a secure context that will be
|
410 | * used if the client request's SNI name matches the supplied hostname
|
411 | * (or wildcard).
|
412 | */
|
413 | addContext(hostName: string, credentials: SecureContextOptions): void;
|
414 | /**
|
415 | * Returns the session ticket keys.
|
416 | */
|
417 | getTicketKeys(): Buffer;
|
418 | /**
|
419 | *
|
420 | * The server.setSecureContext() method replaces the
|
421 | * secure context of an existing server. Existing connections to the
|
422 | * server are not interrupted.
|
423 | */
|
424 | setSecureContext(details: SecureContextOptions): void;
|
425 | /**
|
426 | * The server.setSecureContext() method replaces the secure context of
|
427 | * an existing server. Existing connections to the server are not
|
428 | * interrupted.
|
429 | */
|
430 | setTicketKeys(keys: Buffer): void;
|
431 |
|
432 | /**
|
433 | * events.EventEmitter
|
434 | * 1. tlsClientError
|
435 | * 2. newSession
|
436 | * 3. OCSPRequest
|
437 | * 4. resumeSession
|
438 | * 5. secureConnection
|
439 | * 6. keylog
|
440 | */
|
441 | addListener(event: string, listener: (...args: any[]) => void): this;
|
442 | addListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
443 | addListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
444 | addListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
445 | addListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
446 | addListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
447 | addListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
448 |
|
449 | emit(event: string | symbol, ...args: any[]): boolean;
|
450 | emit(event: "tlsClientError", err: Error, tlsSocket: TLSSocket): boolean;
|
451 | emit(event: "newSession", sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void): boolean;
|
452 | emit(event: "OCSPRequest", certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void): boolean;
|
453 | emit(event: "resumeSession", sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void): boolean;
|
454 | emit(event: "secureConnection", tlsSocket: TLSSocket): boolean;
|
455 | emit(event: "keylog", line: Buffer, tlsSocket: TLSSocket): boolean;
|
456 |
|
457 | on(event: string, listener: (...args: any[]) => void): this;
|
458 | on(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
459 | on(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
460 | on(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
461 | on(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
462 | on(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
463 | on(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
464 |
|
465 | once(event: string, listener: (...args: any[]) => void): this;
|
466 | once(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
467 | once(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
468 | once(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
469 | once(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
470 | once(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
471 | once(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
472 |
|
473 | prependListener(event: string, listener: (...args: any[]) => void): this;
|
474 | prependListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
475 | prependListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
476 | prependListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
477 | prependListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
478 | prependListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
479 | prependListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
480 |
|
481 | prependOnceListener(event: string, listener: (...args: any[]) => void): this;
|
482 | prependOnceListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
|
483 | prependOnceListener(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: (err: Error, resp: Buffer) => void) => void): this;
|
484 | prependOnceListener(event: "OCSPRequest", listener: (certificate: Buffer, issuer: Buffer, callback: (err: Error | null, resp: Buffer) => void) => void): this;
|
485 | prependOnceListener(event: "resumeSession", listener: (sessionId: Buffer, callback: (err: Error, sessionData: Buffer) => void) => void): this;
|
486 | prependOnceListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
|
487 | prependOnceListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
|
488 | }
|
489 |
|
490 | interface SecurePair {
|
491 | encrypted: TLSSocket;
|
492 | cleartext: TLSSocket;
|
493 | }
|
494 |
|
495 | type SecureVersion = 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1';
|
496 |
|
497 | interface SecureContextOptions {
|
498 | /**
|
499 | * Optionally override the trusted CA certificates. Default is to trust
|
500 | * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
|
501 | * replaced when CAs are explicitly specified using this option.
|
502 | */
|
503 | ca?: string | Buffer | Array<string | Buffer>;
|
504 | /**
|
505 | * Cert chains in PEM format. One cert chain should be provided per
|
506 | * private key. Each cert chain should consist of the PEM formatted
|
507 | * certificate for a provided private key, followed by the PEM
|
508 | * formatted intermediate certificates (if any), in order, and not
|
509 | * including the root CA (the root CA must be pre-known to the peer,
|
510 | * see ca). When providing multiple cert chains, they do not have to
|
511 | * be in the same order as their private keys in key. If the
|
512 | * intermediate certificates are not provided, the peer will not be
|
513 | * able to validate the certificate, and the handshake will fail.
|
514 | */
|
515 | cert?: string | Buffer | Array<string | Buffer>;
|
516 | /**
|
517 | * Colon-separated list of supported signature algorithms. The list
|
518 | * can contain digest algorithms (SHA256, MD5 etc.), public key
|
519 | * algorithms (RSA-PSS, ECDSA etc.), combination of both (e.g
|
520 | * 'RSA+SHA384') or TLS v1.3 scheme names (e.g. rsa_pss_pss_sha512).
|
521 | */
|
522 | sigalgs?: string;
|
523 | /**
|
524 | * Cipher suite specification, replacing the default. For more
|
525 | * information, see modifying the default cipher suite. Permitted
|
526 | * ciphers can be obtained via tls.getCiphers(). Cipher names must be
|
527 | * uppercased in order for OpenSSL to accept them.
|
528 | */
|
529 | ciphers?: string;
|
530 | /**
|
531 | * Name of an OpenSSL engine which can provide the client certificate.
|
532 | */
|
533 | clientCertEngine?: string;
|
534 | /**
|
535 | * PEM formatted CRLs (Certificate Revocation Lists).
|
536 | */
|
537 | crl?: string | Buffer | Array<string | Buffer>;
|
538 | /**
|
539 | * Diffie Hellman parameters, required for Perfect Forward Secrecy. Use
|
540 | * openssl dhparam to create the parameters. The key length must be
|
541 | * greater than or equal to 1024 bits or else an error will be thrown.
|
542 | * Although 1024 bits is permissible, use 2048 bits or larger for
|
543 | * stronger security. If omitted or invalid, the parameters are
|
544 | * silently discarded and DHE ciphers will not be available.
|
545 | */
|
546 | dhparam?: string | Buffer;
|
547 | /**
|
548 | * A string describing a named curve or a colon separated list of curve
|
549 | * NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
|
550 | * agreement. Set to auto to select the curve automatically. Use
|
551 | * crypto.getCurves() to obtain a list of available curve names. On
|
552 | * recent releases, openssl ecparam -list_curves will also display the
|
553 | * name and description of each available elliptic curve. Default:
|
554 | * tls.DEFAULT_ECDH_CURVE.
|
555 | */
|
556 | ecdhCurve?: string;
|
557 | /**
|
558 | * Attempt to use the server's cipher suite preferences instead of the
|
559 | * client's. When true, causes SSL_OP_CIPHER_SERVER_PREFERENCE to be
|
560 | * set in secureOptions
|
561 | */
|
562 | honorCipherOrder?: boolean;
|
563 | /**
|
564 | * Private keys in PEM format. PEM allows the option of private keys
|
565 | * being encrypted. Encrypted keys will be decrypted with
|
566 | * options.passphrase. Multiple keys using different algorithms can be
|
567 | * provided either as an array of unencrypted key strings or buffers,
|
568 | * or an array of objects in the form {pem: <string|buffer>[,
|
569 | * passphrase: <string>]}. The object form can only occur in an array.
|
570 | * object.passphrase is optional. Encrypted keys will be decrypted with
|
571 | * object.passphrase if provided, or options.passphrase if it is not.
|
572 | */
|
573 | key?: string | Buffer | Array<Buffer | KeyObject>;
|
574 | /**
|
575 | * Name of an OpenSSL engine to get private key from. Should be used
|
576 | * together with privateKeyIdentifier.
|
577 | */
|
578 | privateKeyEngine?: string;
|
579 | /**
|
580 | * Identifier of a private key managed by an OpenSSL engine. Should be
|
581 | * used together with privateKeyEngine. Should not be set together with
|
582 | * key, because both options define a private key in different ways.
|
583 | */
|
584 | privateKeyIdentifier?: string;
|
585 | /**
|
586 | * Optionally set the maximum TLS version to allow. One
|
587 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
588 | * `secureProtocol` option, use one or the other.
|
589 | * **Default:** `'TLSv1.3'`, unless changed using CLI options. Using
|
590 | * `--tls-max-v1.2` sets the default to `'TLSv1.2'`. Using `--tls-max-v1.3` sets the default to
|
591 | * `'TLSv1.3'`. If multiple of the options are provided, the highest maximum is used.
|
592 | */
|
593 | maxVersion?: SecureVersion;
|
594 | /**
|
595 | * Optionally set the minimum TLS version to allow. One
|
596 | * of `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. Cannot be specified along with the
|
597 | * `secureProtocol` option, use one or the other. It is not recommended to use
|
598 | * less than TLSv1.2, but it may be required for interoperability.
|
599 | * **Default:** `'TLSv1.2'`, unless changed using CLI options. Using
|
600 | * `--tls-v1.0` sets the default to `'TLSv1'`. Using `--tls-v1.1` sets the default to
|
601 | * `'TLSv1.1'`. Using `--tls-min-v1.3` sets the default to
|
602 | * 'TLSv1.3'. If multiple of the options are provided, the lowest minimum is used.
|
603 | */
|
604 | minVersion?: SecureVersion;
|
605 | /**
|
606 | * Shared passphrase used for a single private key and/or a PFX.
|
607 | */
|
608 | passphrase?: string;
|
609 | /**
|
610 | * PFX or PKCS12 encoded private key and certificate chain. pfx is an
|
611 | * alternative to providing key and cert individually. PFX is usually
|
612 | * encrypted, if it is, passphrase will be used to decrypt it. Multiple
|
613 | * PFX can be provided either as an array of unencrypted PFX buffers,
|
614 | * or an array of objects in the form {buf: <string|buffer>[,
|
615 | * passphrase: <string>]}. The object form can only occur in an array.
|
616 | * object.passphrase is optional. Encrypted PFX will be decrypted with
|
617 | * object.passphrase if provided, or options.passphrase if it is not.
|
618 | */
|
619 | pfx?: string | Buffer | Array<string | Buffer | PxfObject>;
|
620 | /**
|
621 | * Optionally affect the OpenSSL protocol behavior, which is not
|
622 | * usually necessary. This should be used carefully if at all! Value is
|
623 | * a numeric bitmask of the SSL_OP_* options from OpenSSL Options
|
624 | */
|
625 | secureOptions?: number; // Value is a numeric bitmask of the `SSL_OP_*` options
|
626 | /**
|
627 | * Legacy mechanism to select the TLS protocol version to use, it does
|
628 | * not support independent control of the minimum and maximum version,
|
629 | * and does not support limiting the protocol to TLSv1.3. Use
|
630 | * minVersion and maxVersion instead. The possible values are listed as
|
631 | * SSL_METHODS, use the function names as strings. For example, use
|
632 | * 'TLSv1_1_method' to force TLS version 1.1, or 'TLS_method' to allow
|
633 | * any TLS protocol version up to TLSv1.3. It is not recommended to use
|
634 | * TLS versions less than 1.2, but it may be required for
|
635 | * interoperability. Default: none, see minVersion.
|
636 | */
|
637 | secureProtocol?: string;
|
638 | /**
|
639 | * Opaque identifier used by servers to ensure session state is not
|
640 | * shared between applications. Unused by clients.
|
641 | */
|
642 | sessionIdContext?: string;
|
643 | }
|
644 |
|
645 | interface SecureContext {
|
646 | context: any;
|
647 | }
|
648 |
|
649 | /*
|
650 | * Verifies the certificate `cert` is issued to host `host`.
|
651 | * @host The hostname to verify the certificate against
|
652 | * @cert PeerCertificate representing the peer's certificate
|
653 | *
|
654 | * Returns Error object, populating it with the reason, host and cert on failure. On success, returns undefined.
|
655 | */
|
656 | function checkServerIdentity(host: string, cert: PeerCertificate): Error | undefined;
|
657 | function createServer(secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
658 | function createServer(options: TlsOptions, secureConnectionListener?: (socket: TLSSocket) => void): Server;
|
659 | function connect(options: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
660 | function connect(port: number, host?: string, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
661 | function connect(port: number, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
|
662 | /**
|
663 | * @deprecated
|
664 | */
|
665 | function createSecurePair(credentials?: SecureContext, isServer?: boolean, requestCert?: boolean, rejectUnauthorized?: boolean): SecurePair;
|
666 | function createSecureContext(details: SecureContextOptions): SecureContext;
|
667 | function getCiphers(): string[];
|
668 |
|
669 | /**
|
670 | * The default curve name to use for ECDH key agreement in a tls server.
|
671 | * The default value is 'auto'. See tls.createSecureContext() for further
|
672 | * information.
|
673 | */
|
674 | let DEFAULT_ECDH_CURVE: string;
|
675 | /**
|
676 | * The default value of the maxVersion option of
|
677 | * tls.createSecureContext(). It can be assigned any of the supported TLS
|
678 | * protocol versions, 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default:
|
679 | * 'TLSv1.3', unless changed using CLI options. Using --tls-max-v1.2 sets
|
680 | * the default to 'TLSv1.2'. Using --tls-max-v1.3 sets the default to
|
681 | * 'TLSv1.3'. If multiple of the options are provided, the highest maximum
|
682 | * is used.
|
683 | */
|
684 | let DEFAULT_MAX_VERSION: SecureVersion;
|
685 | /**
|
686 | * The default value of the minVersion option of tls.createSecureContext().
|
687 | * It can be assigned any of the supported TLS protocol versions,
|
688 | * 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default: 'TLSv1.2', unless
|
689 | * changed using CLI options. Using --tls-min-v1.0 sets the default to
|
690 | * 'TLSv1'. Using --tls-min-v1.1 sets the default to 'TLSv1.1'. Using
|
691 | * --tls-min-v1.3 sets the default to 'TLSv1.3'. If multiple of the options
|
692 | * are provided, the lowest minimum is used.
|
693 | */
|
694 | let DEFAULT_MIN_VERSION: SecureVersion;
|
695 |
|
696 | /**
|
697 | * An immutable array of strings representing the root certificates (in PEM
|
698 | * format) used for verifying peer certificates. This is the default value
|
699 | * of the ca option to tls.createSecureContext().
|
700 | */
|
701 | const rootCertificates: ReadonlyArray<string>;
|
702 | }
|