@@ -468,35 +468,64 @@ to set the security level to 0 while using the default OpenSSL cipher list, you |
468 | 468 |
|
469 | 469 | ```mjs |
470 | 470 | import { createServer, connect } from 'node:tls'; |
471 | | -const port = 443; |
| 471 | +import { readFileSync } from 'node:fs'; |
| 472 | +const port = 8000; |
472 | 473 |
|
473 | | -createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) { |
| 474 | +createServer({ |
| 475 | + key: readFileSync('server-key.pem'), |
| 476 | + cert: readFileSync('server-cert.pem'), |
| 477 | + ciphers: 'DEFAULT@SECLEVEL=0', |
| 478 | + minVersion: 'TLSv1', |
| 479 | +}, function(socket) { |
474 | 480 | console.log('Client connected with protocol:', socket.getProtocol()); |
475 | 481 | socket.end(); |
476 | 482 | this.close(); |
477 | 483 | }) |
478 | 484 | .listen(port, () => { |
479 | | - connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' }); |
| 485 | + connect(port, { |
| 486 | + ciphers: 'DEFAULT@SECLEVEL=0', |
| 487 | + minVersion: 'TLSv1', |
| 488 | + maxVersion: 'TLSv1', |
| 489 | + ca: [ readFileSync('server-cert.pem') ], |
| 490 | + }); |
480 | 491 | }); |
481 | 492 | ``` |
482 | 493 |
|
483 | 494 | ```cjs |
484 | 495 | const { createServer, connect } = require('node:tls'); |
485 | | -const port = 443; |
| 496 | +const { readFileSync } = require('node:fs'); |
| 497 | +const port = 8000; |
486 | 498 |
|
487 | | -createServer({ ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1' }, function(socket) { |
| 499 | +createServer({ |
| 500 | + key: readFileSync('server-key.pem'), |
| 501 | + cert: readFileSync('server-cert.pem'), |
| 502 | + ciphers: 'DEFAULT@SECLEVEL=0', |
| 503 | + minVersion: 'TLSv1', |
| 504 | +}, function(socket) { |
488 | 505 | console.log('Client connected with protocol:', socket.getProtocol()); |
489 | 506 | socket.end(); |
490 | 507 | this.close(); |
491 | 508 | }) |
492 | 509 | .listen(port, () => { |
493 | | - connect(port, { ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1' }); |
| 510 | + connect(port, { |
| 511 | + ciphers: 'DEFAULT@SECLEVEL=0', |
| 512 | + minVersion: 'TLSv1', |
| 513 | + maxVersion: 'TLSv1', |
| 514 | + ca: [ readFileSync('server-cert.pem') ], |
| 515 | + }); |
494 | 516 | }); |
495 | 517 | ``` |
496 | 518 |
|
497 | 519 | This approach sets the security level to 0, allowing the use of legacy features while still |
498 | 520 | leveraging the default OpenSSL ciphers. |
499 | 521 |
|
| 522 | +To generate the certificate and key for this example, run: |
| 523 | + |
| 524 | +```bash |
| 525 | +openssl req -x509 -newkey rsa:2048 -nodes -sha256 -subj '/CN=localhost' \ |
| 526 | + -keyout server-key.pem -out server-cert.pem |
| 527 | +``` |
| 528 | + |
500 | 529 | ### Using [`--tls-cipher-list`][] |
501 | 530 |
|
502 | 531 | You can also set the security level and ciphers from the command line using the |
|