interface

TLSOptions

interface TLSOptions

Options for TLS connections

  • ca?: string | BunFile | BufferSource | unknown[]

    Optionally override the trusted CA certificates. Default is to trust the well-known CAs curated by Mozilla. Mozilla's CAs are completely replaced when CAs are explicitly specified using this option.

    On a server these verify client certificates, which it requests only with requestCert: true.

  • cert?: string | BunFile | BufferSource | unknown[]

    Cert chains in PEM format. One cert chain should be provided per private key. Each cert chain should consist of the PEM formatted certificate for a provided private key, followed by the PEM formatted intermediate certificates (if any), in order, and not including the root CA (the root CA must be pre-known to the peer, see ca). When providing multiple cert chains, they do not have to be in the same order as their private keys in key. If the intermediate certificates are not provided, the peer cannot validate the certificate, and the handshake fails.

  • ciphers?: string
  • crl?: string | BunFile | BufferSource | unknown[]

    PEM formatted CRLs (Certificate Revocation Lists). A peer certificate listed in one of them fails verification: a client certificate when a server sets requestCert, or the server certificate when connecting.

  • dhParamsFile?: string

    File path to a .pem file containing custom Diffie-Hellman parameters

  • key?: string | BunFile | BufferSource | unknown[]

    Private keys in PEM format. PEM allows the option of private keys being encrypted. Encrypted keys are decrypted with options.passphrase. Multiple keys using different algorithms can be provided either as an array of unencrypted key strings or buffers, or an array of objects in the form {pem: <string|buffer>[, passphrase: <string>]}. The object form can only occur in an array. object.passphrase is optional. Encrypted keys are decrypted with object.passphrase if provided, or options.passphrase if it is not.

  • lowMemoryMode?: boolean

    Sets OPENSSL_RELEASE_BUFFERS to 1. Reduces overall performance but saves some memory.

  • passphrase?: string

    Passphrase for the TLS key

  • rejectUnauthorized?: boolean

    If set to false, any certificate is accepted.

    For a server, the default is true. $NODE_TLS_REJECT_UNAUTHORIZED does not change it. For a client, the default is the $NODE_TLS_REJECT_UNAUTHORIZED environment variable, or true if it is not set.

  • requestCert?: boolean

    If set to true, the server requests a client certificate, and refuses a client without a valid one unless rejectUnauthorized is false. This option alone decides it: ca does not request a certificate.

    Default is false.

  • secureOptions?: number

    Optionally affect the OpenSSL protocol behavior, which is not usually necessary. Use it carefully, if at all. Value is a numeric bitmask of the SSL_OP_* options from OpenSSL Options

  • servername?: string

    Alias of serverName, the node:tls spelling. serverName wins if both are set.

  • serverName?: string

    Explicitly set a server name