View source

typedef TlsConnectOptions

package js.node

import js.node.Tls

Fields

@:optionaloptionalsocket:Null<Socket>

Establish secure connection on a given socket rather than creating a new socket. If this option is specified, host and port are ignored.

@:optionaloptionalsessionIdContext:Null<String>

opaque identifier for session resumption. If requestCert is true, the default is MD5 hash value generated from command-line. Otherwise, the default is not provided.

@:optionaloptionalsession:Null<Buffer>

A Buffer instance, containing TLS session.

@:optionaloptionalservername:Null<String>

Servername for SNI (Server Name Indication) TLS extension.

@:optionaloptionalsecureProtocol:Null<String>

The SSL method to use, e.g. SSLv3_method to force SSL version 3. The possible values depend on your installation of OpenSSL and are defined in the constant SSL_METHODS.

@:optionaloptionalrequestOCSP:Null<Bool>

If true - OCSP status request extension would be added to client hello, and OCSPResponse event will be emitted on socket before establishing secure communication

@:optionaloptionalrejectUnauthorized:Null<Bool>

If true the server will reject any connection which is not authorized with the list of supplied CAs. This option only has an effect if requestCert is true. Default: false.

@:optionaloptionalport:Null<Int>

Port the client should connect to

@:optionaloptionalpfx:Null<EitherType<String, Buffer>>

private key, certificate and CA certs of the server in PFX or PKCS12 format.

@:optionaloptionalpath:Null<String>

Creates unix socket connection to path. If this option is specified, host and port are ignored.

@:optionaloptionalpassphrase:Null<String>

passphrase for the private key or pfx.

@:optionaloptionalkey:Null<EitherType<String, Buffer>>

private key of the server in PEM format.

@:optionaloptionalhost:Null<String>

Host the client should connect to. Defaults to 'localhost'

@:optionaloptionalhonorCipherOrder:Null<Bool>

When choosing a cipher, use the server's preferences instead of the client preferences. Default: true.

@:optionaloptionalecdhCurve:Null<String>

named curve to use for ECDH key agreement or false to disable ECDH.

Defaults to prime256v1 (NIST P-256). Use Crypto.getCurves to obtain a list of available curve names. On recent releases, openssl ecparam -list_curves will also display the name and description of each available elliptic curve.

@:optionaloptionaldhparam:Null<EitherType<String, Buffer>>

Diffie Hellman parameters, required for Perfect Forward Secrecy.

Use openssl dhparam to create it. Its key length should be greater than or equal to 1024 bits, otherwise it throws an error. It is strongly recommended to use 2048 bits or more for stronger security. If omitted or invalid, it is silently discarded and DHE ciphers won't be available.

@:optionaloptionalcrl:Null<EitherType<String, Array<String>>>

PEM encoded CRLs (Certificate Revocation List)

@:optionaloptionalciphers:Null<String>

ciphers to use or exclude.

To mitigate BEAST attacks it is recommended that you use this option in conjunction with the honorCipherOrder option described below to prioritize the non-CBC cipher.

Defaults to AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH.

Consult the OpenSSL cipher list format documentation for details on the format. ECDH (Elliptic Curve Diffie-Hellman) ciphers are not yet supported.

@:optionaloptionalcheckServerIdentity:Null<(String, {}) ‑> Dynamic>

An override for checking server's hostname against the certificate. Should return an error if verification fails. Return js.Lib.undefined if passing.

@:optionaloptionalcert:Null<EitherType<String, Buffer>>

certificate key of the server in PEM format.

@:optionaloptionalca:Null<Array<EitherType<String, Buffer>>>

trusted certificates in PEM format. If this is omitted several well known "root" CAs will be used, like VeriSign. These are used to authorize connections.

@:optionaloptionalNPNProtocols:Null<EitherType<Array<String>, Buffer>>

possible NPN protocols. (Protocols should be ordered by their priority).