Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Forcing TLS 1.1 or higher on node.js

Tags:

node.js

ssl

I'm trying to create a server that would use TLS 1.1 or higher.

This is my current TLS configuration:

var options = {};
options.key  = fs.readFileSync('privatekey.pem');
options.cert = fs.readFileSync('certificate.pem');
options.secureProtocol = 'TLSv1_server_method';
options.ciphers = "AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH";
options.honorCipherOrder = true;
httpServer = https.createServer(options, app);

Just as was suggested here

From reading Openssl's guide here I didn't find anything about TLS 1.1

Any suggestions?

like image 444
Oleg.R Avatar asked Apr 02 '14 08:04

Oleg.R


People also ask

Is TLS 1.1 Enabled by default?

If you have installed the latest system patch, TLS1. 0, 1.1 and 1.2 both enabled on server by default. You can get this information from Microsoft docs.

Why are TLS v1 0 and v1 1 no longer recommended?

Risk of outdated TLS protocolsTLS 1.0 and 1.1 are vulnerable to downgrade attacks since they rely on SHA-1 hash for the integrity of exchanged messages. Even authentication of handshakes is done based on SHA-1, which makes it easier for an attacker to impersonate a server for MITM attacks.

Has TLS 1.1 been deprecated?

For Microsoft 365 operated by 21 Vianet, TLS 1.0/1.1 will be disabled on June 30, 2023. As of October 31, 2018, the Transport Layer Security (TLS) 1.0 and 1.1 protocols are deprecated for the Microsoft 365 service.


1 Answers

TLS 1.0 should no longer be used. This works to disable TLS 1.0 in node.js:

https.createServer({
        secureOptions: require('constants').SSL_OP_NO_TLSv1,
        pfx: fs.readFileSync(path.resolve(pathToCert))
    }, app).listen(443);

You can verify this using this tool: ssllabs

like image 156
user896993 Avatar answered Sep 28 '22 01:09

user896993