View source

typedef SecureContextOptions

package js.node.tls

import js.node.tls.SecureContext

Fields

@:optionaloptionalsessionIdContext:Null<String>

opaque identifier for session resumption. If requestCert is true, the default is MD5 hash value generated from command-line. Otherwise, the default is not provided.

@:optionaloptionalsecureProtocol:Null<String>

The SSL method to use, e.g. SSLv3_method to force SSL version 3. The possible values depend on your installation of OpenSSL and are defined in the constant SSL_METHODS.

@:optionaloptionalpfx:Null<EitherType<String, Buffer>>

private key, certificate and CA certs of the server in PFX or PKCS12 format.

@:optionaloptionalpassphrase:Null<String>

passphrase for the private key or pfx.

@:optionaloptionalkey:Null<EitherType<String, Buffer>>

private key of the server in PEM format.

@:optionaloptionalhonorCipherOrder:Null<Bool>

When choosing a cipher, use the server's preferences instead of the client preferences. Default: true.

@:optionaloptionalecdhCurve:Null<String>

named curve to use for ECDH key agreement or false to disable ECDH.

Defaults to prime256v1 (NIST P-256). Use Crypto.getCurves to obtain a list of available curve names. On recent releases, openssl ecparam -list_curves will also display the name and description of each available elliptic curve.

@:optionaloptionaldhparam:Null<EitherType<String, Buffer>>

Diffie Hellman parameters, required for Perfect Forward Secrecy.

Use openssl dhparam to create it. Its key length should be greater than or equal to 1024 bits, otherwise it throws an error. It is strongly recommended to use 2048 bits or more for stronger security. If omitted or invalid, it is silently discarded and DHE ciphers won't be available.

@:optionaloptionalcrl:Null<EitherType<String, Array<String>>>

PEM encoded CRLs (Certificate Revocation List)

@:optionaloptionalciphers:Null<String>

ciphers to use or exclude.

To mitigate BEAST attacks it is recommended that you use this option in conjunction with the honorCipherOrder option described below to prioritize the non-CBC cipher.

Defaults to AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH.

Consult the OpenSSL cipher list format documentation for details on the format. ECDH (Elliptic Curve Diffie-Hellman) ciphers are not yet supported.

@:optionaloptionalcert:Null<EitherType<String, Buffer>>

certificate key of the server in PEM format.

@:optionaloptionalca:Null<Array<EitherType<String, Buffer>>>

trusted certificates in PEM format. If this is omitted several well known "root" CAs will be used, like VeriSign. These are used to authorize connections.