node:tls
#Import
import tls from "nstdlib/node/tls";Note
The API is available, but not everything works. No OpenSSL, so tls.connect() cannot make a secure context unless a host fills the node_binding_crypto_secure_context_dispatch and node_binding_tls_wrap_dispatch hooks. native/ does, over mbedTLS, and tls.connect() then verifies a chain for real. rootCertificates and getCACertificates() answer [] unless a host fills the getBundledRootCertificates hook. native/ does, from the pinned ./node's own store.
#Support
- nstd: Gives the same output as Node.js in side-by-side tests: tls.
- Browser: Loads with a minimal
processobject. 17 of Node's 17 exports are available. 1 of 1 behavior checks match Node.js.
#Exports (19)
Every name Node.js exports from this module, and what you get when you read it, as a named import or as a property of the default import:
- ✅ A value, both ways. An export that throws an error naming the missing feature also counts.
- ⚠️ A value one way,
undefinedthe other. - ❔
undefinedboth ways. - ❌ Not exported at all.
- – Not measured.
| Export | Node.js | Browser |
|---|---|---|
CLIENT_RENEG_LIMIT | ✅ | ✅ |
CLIENT_RENEG_WINDOW | ✅ | ✅ |
DEFAULT_CIPHERS | ✅ | ✅ |
DEFAULT_ECDH_CURVE | ✅ | ✅ |
DEFAULT_MAX_VERSION | ✅ | ✅ |
DEFAULT_MIN_VERSION | ✅ | ✅ |
SecureContext | ✅ | ✅ |
Server | ✅ | ✅ |
TLSSocket | ✅ | ✅ |
checkServerIdentity | ✅ | ✅ |
connect | ✅ | ✅ |
convertALPNProtocols | ✅ | ✅ |
createSecureContext | ✅ | ✅ |
createServer | ✅ | ✅ |
getCACertificates | ✅ | ✅ |
getCertificateCompressionAlgorithms | ✅ | ✅ |
getCiphers | ✅ | ✅ |
rootCertificates | ✅ | ✅ |
setDefaultCACertificates | ✅ | ✅ |
#Diagnostics
nstdlib running inside Node.js. This isn't an environment it's meant for, so it isn't shown above, but it tells a library problem from an environment one:
coverage: 19/19 of the host's export names answer inside host node. API only. No OpenSSL, sotls.connect()cannot make a secure context unless a host fills thenode_binding_crypto_secure_context_dispatchandnode_binding_tls_wrap_dispatchhooks.native/does, over mbedTLS, andtls.connect()then verifies a chain for real.rootCertificatesandgetCACertificates()answer[]unless a host fills thegetBundledRootCertificateshook.native/does, from the pinned./node's own store.smoke: Imports in a clean child process.node-suite: 12/214 of Node's own eligible tests pass with ./dist inside host node. A failure there and in the page is the library's, one only in the page is the engine's.