5

I am currently experiencing a known problem with OpenSSL on Ubuntu 12.04. This problem is already fixed in Debian and I'm expecting it to be fixed soon in Ubuntu too. However, in the mean time I would need a workaround.

So is it possible to disable TLS1 in Node and have something equivalent to tls1 switch:

openssl s_client -tls1 -connect evernote.com:443

Here is a simple Node.js script to replicate the problem (on Ubuntu 12.04 w/ OpenSSL 1.0.1)

var https = require('https');
https.get({
    host: 'www.evernote.com',
    path: '/',
    port: 443
  }, function (res) {
    console.log('Success!');
  });

2 Answers 2

5

Judging from the documentation and the sources (1, 2), it should be possible to pass an options object to request that contains something like

options = { secureProtocol: 'TLSv1_method' }

in order to use TLSv1 (and just that) for this particular connection.

The default is to use OpenSSL's SSLv23_method, which means to use the highest TLS/SSL version that is possibly understood by both parties.

Although possible in OpenSSL itself, it is not possible to blacklist a particular TLS version (as in "use the highest version possible, but never this one") in node.js as far as I can see, the necessary flags to do so are not exported in node.js itself.

5
  • AWESOME reverse-engineering! Too bad it seems I want be able to do what I would need to :( Are you sure it works like that? I tried using various values (SSLv2_method, TLSv1_method) for secureProtocol, but seems like I get the same error regardless (Error: socket hang up, at SecurePair.error (tls.js:802:15)) Thanks a million so far!
    – jsalonen
    May 27, 2012 at 22:52
  • I didn't get it to work, but I think this is basically as far as we can go with the information available. Thanks!
    – jsalonen
    May 29, 2012 at 13:31
  • Yes, sorry I didn't have the time to investigate further. If I manage to find out what could have gone wrong, I'll put it in a comment here!
    – emboss
    May 29, 2012 at 13:37
  • jsalonen, have you figure it out? By the way, where should the options go to? in HttpsOptions? or where?
    – murvinlai
    Aug 14, 2012 at 23:15
  • 1
    @jsalonen They go in a new https.Agent.
    – Ryan Olds
    Sep 5, 2012 at 17:57
2

I ran into a bug where I couldn't connect to livefilestore.com over ssl via node. Here is what fixed it:

var https = require('https');

var HTTPS_AGENT = new https.Agent({
 secureProtocol: 'SSLv3_method'     // default is SSLv23_method
});

var req_opts = {...};

req_opts.agent = HTTPS_AGENT;

https.request(req_opts, function(res) { ... });

Interestingly, I was able to reproduce the error in curl with more recent versions of libopenssl, but my older boxes didn't reproduce the issue. I was able to reproduce on Ubuntu and Gentoo. In experimenting with curl, using the -2 always breaks (differently though, doesn't hang, just reports unsupported) and -3 never reproduced the problem. I don't know if that is related at all. Without specifying -3 it tries and fails to do an SSLv3 handshake. Strange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.