nodejs/node

SSLv3 connectivity in Node LTS

gschwa opened this issue · 7 comments

gschwa commented

Believe it or not there are still "secure" sites running SSLv3 and I need to connect to it. When I set the:

secureProtocol: 'SSLv3_method'

I get back: Error: SSLv3 methods disabled

I am using Node 4.2.2. Is there anything I can do to enable SSLv3?

Fishrock123 commented

No, we build without SSLv3 support as it is effectively broken entirely and you might as well be using regular http.

See:

  • 👎1
  • 😕1
mscdex commented

Your only option is to use an old version of node, but still you really should not be using anything less than TLSv1 at this point if you care about security. You might contact the server owner and ask them to at least permit TLSv1+ connections.

evanlucas commented

Closing as there isn't really anything actionable that we can do on this one

richardzyx commented

What's the standard practice to let node throw an exception/warning message when using SSLv3/2? I had to spend quite some time debugging this issue since I just picked node back up and wasn't aware of this functionality. The only way I could get more information was from openssl cli, but it would have've been much nicer if there are existing warning or documentations.

In my case, the same key/cert worked for a Java application so the debugging process has been particularly painful.

If I missed anything apparent, please feel free to let me know. Thanks!

Trott commented

@richardzyx Hi! This issue tracker is for bugs and issues found within Node.js core.
For more general support questions like that, please file an issue on our help
repo. https://github.com/nodejs/help

Thanks!

  • 👍1
YuriyTigiev commented

Hi!

What version of nodejs and which modules supported TLSv1/SSLv3?
I develop a script that should get data from the sites running TLSv1/SSLv3.

Trott commented

@YuriyTigiev Not sure what you mean by "which modules" but SSLv3 has been disabled-by-default since Node.js 4.0.0. (It was disabled during the io.js fork.)

I'm going to lock this issue. For more questions or clarifications, consider opening a new issue in this repo or in https://github.com/nodejs/help. You can also ask on StackOverflow, in IRC, etc.