node:tls

#Import

import tls from "nstdlib/node/tls";

Note

The API is available, but not everything works. No OpenSSL, so tls.connect() cannot make a secure context unless a host fills the node_binding_crypto_secure_context_dispatch and node_binding_tls_wrap_dispatch hooks. native/ does, over mbedTLS, and tls.connect() then verifies a chain for real. rootCertificates and getCACertificates() answer [] unless a host fills the getBundledRootCertificates hook. native/ does, from the pinned ./node's own store.

#Support

node:tls. nstd: works; Node test suite 12.5% passing. Browser: works; export coverage 100%; Node test suite 6.3% passing.

  • nstd: Gives the same output as Node.js in side-by-side tests: tls.
  • Browser: Loads with a minimal process object. 17 of Node's 17 exports are available. 1 of 1 behavior checks match Node.js.

#Exports (19)

Every name Node.js exports from this module, and what you get when you read it, as a named import or as a property of the default import:

  • ✅ A value, both ways. An export that throws an error naming the missing feature also counts.
  • ⚠️ A value one way, undefined the other.
  • ❔ undefined both ways.
  • ❌ Not exported at all.
  • – Not measured.
ExportNode.jsBrowser
CLIENT_RENEG_LIMIT✅✅
CLIENT_RENEG_WINDOW✅✅
DEFAULT_CIPHERS✅✅
DEFAULT_ECDH_CURVE✅✅
DEFAULT_MAX_VERSION✅✅
DEFAULT_MIN_VERSION✅✅
SecureContext✅✅
Server✅✅
TLSSocket✅✅
checkServerIdentity✅✅
connect✅✅
convertALPNProtocols✅✅
createSecureContext✅✅
createServer✅✅
getCACertificates✅✅
getCertificateCompressionAlgorithms✅✅
getCiphers✅✅
rootCertificates✅✅
setDefaultCACertificates✅✅

#Diagnostics

nstdlib running inside Node.js. This isn't an environment it's meant for, so it isn't shown above, but it tells a library problem from an environment one:

  • coverage: 19/19 of the host's export names answer inside host node. API only. No OpenSSL, so tls.connect() cannot make a secure context unless a host fills the node_binding_crypto_secure_context_dispatch and node_binding_tls_wrap_dispatch hooks. native/ does, over mbedTLS, and tls.connect() then verifies a chain for real. rootCertificates and getCACertificates() answer [] unless a host fills the getBundledRootCertificates hook. native/ does, from the pinned ./node's own store.
  • smoke: Imports in a clean child process.
  • node-suite: 12/214 of Node's own eligible tests pass with ./dist inside host node. A failure there and in the page is the library's, one only in the page is the engine's.