Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tls: fix DEP0083 after upgrading to OpenSSL 1.1.0 #22953

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions doc/api/deprecations.md
Original file line number Diff line number Diff line change
Expand Up @@ -1648,17 +1648,20 @@ the `REPLServer` itself. Do not use this function.
### DEP0083: Disabling ECDH by setting ecdhCurve to false
<!-- YAML
changes:
- version: v10.0.0
pr-url: https://github.com/nodejs/node/pull/19794
description: End-of-Life.
- version: v9.2.0
pr-url: https://github.com/nodejs/node/pull/16130
description: Runtime deprecation.
-->

Type: Runtime
Type: End-of-Life.

The `ecdhCurve` option to `tls.createSecureContext()` and `tls.TLSSocket` could
be set to `false` to disable ECDH entirely on the server only. This mode is
be set to `false` to disable ECDH entirely on the server only. This mode was
deprecated in preparation for migrating to OpenSSL 1.1.0 and consistency with
the client. Use the `ciphers` parameter instead.
the client and is now unsupported. Use the `ciphers` parameter instead.

<a id="DEP0084"></a>
### DEP0084: requiring bundled internal dependencies
Expand Down
6 changes: 5 additions & 1 deletion doc/api/tls.md
Original file line number Diff line number Diff line change
Expand Up @@ -1007,6 +1007,10 @@ argument.
<!-- YAML
added: v0.11.13
changes:
- version: v10.0.0
pr-url: https://github.com/nodejs/node/pull/19794
description: The `ecdhCurve` cannot be set to `false` anymore due to a
change in OpenSSL.
- version: v9.3.0
pr-url: https://github.com/nodejs/node/pull/14903
description: The `options` parameter can now include `clientCertEngine`.
Expand Down Expand Up @@ -1062,7 +1066,7 @@ changes:
discarded and DHE ciphers will not be available.
* `ecdhCurve` {string} A string describing a named curve or a colon separated
list of curve NIDs or names, for example `P-521:P-384:P-256`, to use for
ECDH key agreement, or `false` to disable ECDH. Set to `auto` to select the
ECDH key agreement. Set to `auto` to select the
curve automatically. Use [`crypto.getCurves()`][] to obtain a list of
available curve names. On recent releases, `openssl ecparam -list_curves`
will also display the name and description of each available elliptic curve.
Expand Down
12 changes: 0 additions & 12 deletions lib/_tls_common.js
Original file line number Diff line number Diff line change
Expand Up @@ -69,16 +69,6 @@ function validateKeyCert(name, value) {
exports.SecureContext = SecureContext;


function ecdhCurveWarning() {
if (ecdhCurveWarning.emitted) return;
process.emitWarning('{ ecdhCurve: false } is deprecated.',
'DeprecationWarning',
'DEP0083');
ecdhCurveWarning.emitted = true;
}
ecdhCurveWarning.emitted = false;


exports.createSecureContext = function createSecureContext(options, context) {
if (!options) options = {};

Expand Down Expand Up @@ -154,8 +144,6 @@ exports.createSecureContext = function createSecureContext(options, context) {
c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE);
else if (options.ecdhCurve)
c.context.setECDHCurve(options.ecdhCurve);
else
ecdhCurveWarning();

if (options.dhparam) {
const warning = c.context.setDHParam(options.dhparam);
Expand Down
66 changes: 0 additions & 66 deletions test/parallel/test-tls-ecdh-disable.js

This file was deleted.