Configure https agent to allow only TLS1.2 for outgoing requests

Question

I'm making HTTPS connections from a node app, using a client certificate:

var options = { 
    hostname: 'https://my-server.com', 
    port: 443, 
    path: '/', 
    method: 'GET', 
    key: fs.readFileSync('client1-key.pem'), 
    cert: fs.readFileSync('client1-crt.pem'), 
    ca: fs.readFileSync('ca-crt.pem') }; 

var req = https.request(options, res => { 
    [...]
});

Everything is working fine, however I want to add code to ensure only TLS 1.2 connections are allowed. I cannot find any way to configure this in the https.agent options, or elsewhere. Is it possible to configure this, or do I have to make a connection and then query the protocol version, with something like:

res.socket.getProtocol() === 'TLSv1.2'

and abort the connection if the protocol is not satisfactory?

alternatively you can use nginx as a reverse proxy to terminate your TLS traffic so shielding nodejs from having to deal with https yet communicate with outside world via https ... removing the complexity of asking nodejs to handle any TLS related matters entirely ... nginx is config driven, no need to code security logic ... nginx also handles WebSockets — Scott Stensland, Jun 19 '17 at 16:25

supersam654 · Accepted Answer · 2019-06-18T19:03:33.493

32

First I found the docs on making HTTPS requests. It mentions that you can pass additional options to tls.connect() which includes something called secureProtocol. Digging into tls.connect(), I found the secureContext option which mentions tls.createSecureContext(). And there it finally mentions secureProtocol which can be specified with a string from an OpenSSL page. I picked a string that looked reasonable (TLSv1_2_method) and passed the secureProtocol option directly into https.request.

This prints SSL Version: TLS 1.2 with the given secureProtocol and SSL Version: TLS 1.1 with secureProtocol: "TLSv1_1_method". The error handler at the end will get called if a connection cannot be established with the given TLS version.

var https = require('https')

var options = {
    hostname: 'www.howsmyssl.com',
    port: 443,
    path: '/a/check',
    method: 'GET',
    secureProtocol: "TLSv1_2_method"
}

https.request(options, res => {
  let body = ''
  res.on('data', d => body += d)
  res.on('end', () => {
    data = JSON.parse(body)
    console.log('SSL Version: ' + data.tls_version)
  })
}).on('error', err => {
  // This gets called if a connection cannot be established.
  console.warn(err)
}).end()

edited Jun 18 '19 at 19:03

answered Jun 19 '17 at 16:18

supersam654

3,126
33
34

Brilliant answer, this worked great. Really helpful, thanks! – JHH Jun 20 '17 at 07:20
adding the test for success: openssl s_client -connect example.com:443 -tls1 - should fail openssl s_client -connect example.com:443 -tls1_2 should not – richardwhitney Dec 12 '17 at 22:44
@supersam654 the link is openssl link is broken. Possibly, the new link is http://openssl.cs.utah.edu/docs/ssl/ssl.html#dealing_with_protocol_methods – coding_idiot Jun 17 '19 at 18:08
@coding_idiot thanks for letting me know. I did a bit of spelunking and found the correct link on openssl.org. https://stackoverflow.com/revisions/44635449/2 – supersam654 Jun 18 '19 at 19:04
Did you figure out how to do this with a HTTPs agent? – atymic Nov 23 '19 at 08:09
What's the default value node uses? – TemporaryFix Dec 11 '19 at 17:18
I still don't understand why axios and fetch does not support tlsv.12 out of box. :sad – tim Aug 01 '23 at 21:12

score 9 · Answer 2 · answered May 27 '20 at 19:50

Just an update about this solution, a couple of years have passed and some things have changed.

Node docs now recommends to use minVersion and maxVersion instead secureProtocol since this last option has become the legacy mechanism to select the TLS protocol version, so you can get the same result by using minVersion: "TLSv1.2":

var https = require('https')

var options = {
    hostname: 'www.howsmyssl.com',
    port: 443,
    path: '/a/check',
    method: 'GET',
    minVersion: "TLSv1.2",
    maxVersion: "TLSv1.2"
}
...

References: Node docs: tls_tls_createsecurecontext_options

Configure https agent to allow only TLS1.2 for outgoing requests

2 Answers2

Linked