Options
All
  • Public
  • Public/Protected
  • All
Menu

Class TlsContextOptions

Options for creating a ClientTlsContext or ServerTlsContext.

nodejs only.

Hierarchy

  • TlsContextOptions

Index

Type aliases

Static Pkcs11Options

Pkcs11Options: { cert_file_contents?: undefined | string; cert_file_path?: undefined | string; pkcs11_lib: Pkcs11Lib; private_key_object_label?: undefined | string; slot_id?: undefined | number; token_label?: undefined | string; user_pin: null | string }

Options for TLS using a PKCS#11 library for private key operations.

Unix only. nodejs only.

see

TlsContextOptions.create_client_with_mtls_pkcs11

Type declaration

  • Optional cert_file_contents?: undefined | string

    Use this X.509 certificate (contents in memory). The certificate must be PEM-formatted. The certificate may be specified by other means instead (ex: cert_file_path)

  • Optional cert_file_path?: undefined | string

    Use this X.509 certificate (file on disk). The certificate must be PEM-formatted. The certificate may be specified by other means instead (ex: cert_file_contents)

  • pkcs11_lib: Pkcs11Lib

    Use this PKCS#11 library.

  • Optional private_key_object_label?: undefined | string

    Specify the label of the private key object on the PKCS#11 token. If not specified, the key will be chosen based on other criteria (such as being the only available private key on the token).

  • Optional slot_id?: undefined | number

    Specify the slot ID containing a PKCS#11 token. If not specified, the token will be chosen based on other criteria (such as token_label).

  • Optional token_label?: undefined | string

    Specify the label of the PKCS#11 token to use. If not specified, the token will be chosen based on other criteria (such as slot_id).

  • user_pin: null | string

    Use this PIN to log the user into the PKCS#11 token. Pass null to log into a token with a "protected authentication path".

Properties

alpn_list

alpn_list: string[] = []

List of ALPN protocols to be used on platforms which support ALPN

Optional ca_dirpath

ca_dirpath: undefined | string

Path to directory containing trust anchors. Only used on Unix-style systems.

Optional ca_filepath

ca_filepath: undefined | string

Path to a single file with all trust anchors in it, in PEM format

Optional certificate

certificate: undefined | string

Certificate, in PEM format

Optional certificate_authority

certificate_authority: undefined | string

String with all trust anchors in it, in PEM format

Optional certificate_filepath

certificate_filepath: undefined | string

Path to certificate, in PEM format

min_tls_version

min_tls_version: TlsVersion = TlsVersion.Default

Minimum version of TLS to support. Uses OS/system default if unspecified.

Optional pkcs11_options

pkcs11_options: Pkcs11Options

PKCS#11 options. Currently, only supported on Unix

Optional pkcs12_filepath

pkcs12_filepath: undefined | string

Path to certificate, in PKCS#12 format. Currently, only supported on OSX

Optional pkcs12_password

pkcs12_password: undefined | string

Password for PKCS#12. Currently, only supported on OSX.

Optional private_key

private_key: undefined | string

Private key, in PEM format

Optional private_key_filepath

private_key_filepath: undefined | string

Path to private key, in PEM format

verify_peer

verify_peer: boolean = true

In client mode, this turns off x.509 validation. Don't do this unless you are testing. It is much better to just override the default trust store and pass the self-signed certificate as the ca_file argument.

In server mode (ServerTlsContext), this defaults to false. If you want to enforce mutual TLS on the server, set this to true.

Methods

override_default_trust_store

  • override_default_trust_store(certificate_authority: string): void
  • Overrides the default system trust store.

    Parameters

    • certificate_authority: string

      String containing all trust CAs, in PEM format

    Returns void

override_default_trust_store_from_path

  • override_default_trust_store_from_path(ca_dirpath?: undefined | string, ca_filepath?: undefined | string): void
  • Overrides the default system trust store.

    Parameters

    • Optional ca_dirpath: undefined | string

      Only used on Unix-style systems where all trust anchors are stored in a directory (e.g. /etc/ssl/certs).

    • Optional ca_filepath: undefined | string

      Single file containing all trust CAs, in PEM format

    Returns void

Static create_client_with_mtls

  • create_client_with_mtls(certificate: string, private_key: string): TlsContextOptions
  • Create options configured for mutual TLS in client mode, with client certificate and private key provided as in-memory strings.

    Parameters

    • certificate: string

      Client certificate file contents, in PEM format

    • private_key: string

      Client private key file contents, in PEM format

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Static create_client_with_mtls_from_path

  • create_client_with_mtls_from_path(certificate_filepath: string, private_key_filepath: string): TlsContextOptions
  • Create options configured for mutual TLS in client mode, with client certificate and private key provided via filepath.

    Parameters

    • certificate_filepath: string

      Path to client certificate, in PEM format

    • private_key_filepath: string

      Path to private key, in PEM format

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Static create_client_with_mtls_pkcs11

  • Create options configured for mutual TLS in client mode, using a PKCS#11 library for private key operations.

    NOTE: This configuration only works on Unix devices.

    Parameters

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Static create_client_with_mtls_pkcs12_from_path

  • create_client_with_mtls_pkcs12_from_path(pkcs12_filepath: string, pkcs12_password: string): TlsContextOptions
  • Create options for mutual TLS in client mode, with client certificate and private key bundled in a single PKCS#12 file.

    Parameters

    • pkcs12_filepath: string

      Path to PKCS#12 file containing client certificate and private key.

    • pkcs12_password: string

      PKCS#12 password

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Static create_client_with_mtls_pkcs_from_path

  • create_client_with_mtls_pkcs_from_path(pkcs12_filepath: string, pkcs12_password: string): TlsContextOptions

Static create_server_with_mtls_from_path

  • create_server_with_mtls_from_path(certificate_filepath: string, private_key_filepath: string): TlsContextOptions
  • Creates TLS context with peer verification disabled, along with a certificate and private key

    Parameters

    • certificate_filepath: string

      Path to certificate, in PEM format

    • private_key_filepath: string

      Path to private key, in PEM format

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Static create_server_with_mtls_pkcs_from_path

  • create_server_with_mtls_pkcs_from_path(pkcs12_filepath: string, pkcs12_password: string): TlsContextOptions
  • Creates TLS context with peer verification disabled, along with a certificate and private key in PKCS#12 format

    Parameters

    • pkcs12_filepath: string

      Path to certificate, in PKCS#12 format

    • pkcs12_password: string

      PKCS#12 Password

    Returns TlsContextOptions

    newly configured TlsContextOptions object

Generated using TypeDoc