https: no error reported when certificate not provided for createServer()

Version: v6.10.0
Platform: Windows 10 64-bit

When calling https.createServer({ }) with an empty opts argument, the listening event is emitted, however no port is bound. Also, no error is emitted/thrown.

However, if a value for the options pfx, path, or key given in opts is invalid/incorrect createServer will emit/throw an error is the correct behavior, which I assume is the correct behavior. As such, shouldn't an error be thrown for the case when no certificate is provided?

Example:

var https = require('https');

var server = https.createServer({ });

server.on('error', function(err){ console.log(err); });
server.on('listening', function(){ console.log("listening!"); });

server.listen(5000);

// => outputs listening!

Cipher suites exist that don't need a private key, that's why it's not an error.

But why is the listening event emitting even though there's no server listening?

Because it's listening - at least, for me it is. With your example, lsof -ni tcp shows node on port 5000.

Yes, my bad. I checked again using netstat -a | grep 5000 and it is listening.

Knowing this now, I used curl and got this error:

curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

In what case is this setup used/useful for?

NULL cipher suites: https://github.com/nodejs/node/blob/master/test/parallel/test-tls-no-cert-required.js#L32-L34

That makes sense, but in the documentation for TLS AECDH-NULL-SHA is not in the default cipher suite, and as you can see in my example, we specify no specific suite, therefore it uses the default. None of the listed suites in the default use NULL, and if I'm not mistaken, this section of the list:

!aNULL:
!eNULL:

means to not use any NULL cipher suites, correct?

Correct, but node.js does not recognize individual ciphers, it just passes them on to openssl. As well, it's possible to hook up custom engines and hardware devices to openssl, in which case node.js wouldn't even see the key.

It would be good to error on invalid config, I just don't think we can get openssl to tell us it has insufficient identity until a handshake occurs. Can we close this as "can't improve", or should we leave it open as a "wish this could be better"?

I can't think of any that wouldn't close the door on some use cases. I'll go ahead and close this out but if someone has a good suggestion, please post a comment.

Navigation Menu

Repository navigation

https: no error reported when certificate not provided for createServer() #11978

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

https: no error reported when certificate not provided for createServer() #11978

Description

Activity

bnoordhuis commented on Mar 22, 2017

portaljacker commented on Mar 22, 2017

bnoordhuis commented on Mar 22, 2017

portaljacker commented on Mar 22, 2017

sam-github commented on Mar 22, 2017

portaljacker commented on Mar 23, 2017

bnoordhuis commented on Mar 23, 2017

sam-github commented on Mar 23, 2017

bnoordhuis commented on Mar 23, 2017

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions