As part of the fix for logjam, node was upgraded to a
level of openssl which rejects connections to servers that
are using keys smaller than 768 bits. It is still possible,
however, to create a server that uses a smaller key size
and and older client may be able to connect to it.
This PR moves us to a secure by default stance on the
server side as well, preventing the creation of a server
using a dhe key size less than 768. This can be overridden
with the command line option which is also added.
It is derived from
9b35be5810
which was landed in later io.js/node versions but makes
the limit 1024. This PR uses the smaller limit in order
to meet the recomendations for logjam while matching was
was done on the client side in openssl to minimize the
potential impacton users.
The command line option will only be documented in the
release notes and will not be added to the tls
documentation. The goal is that people who are
upgrading are aware and can use the option if they
run into issues, but otherwise the option is not
visible/used.
PR-URL: https://github.com/nodejs/node/pull/3890
Fixes: https://github.com/nodejs/LTS/issues/49
Reviewed-By: Myles Borins <mborins@us.ibm.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Test of 512 bits key is failed after upgrading openssl-1.0.1o due to
its limit of 768 bits key size. Remove it and start from 1024 bits
test.
Reviewed-By: Michael Dawson <mdawson@devrus.com>
PR-URL: https://github.com/joyent/node/pull/25533
Strings are treated as UTF8 instead of one-byte strings when
names are processed and when OpenSSL's ..._print functions are used.
This commit fixes simple/test-tls-peer-certificate-encoding test.
fix#8366
In case of an invalid DH parameter file, it is sliently discarded. To
use auto DH parameter in a server and DHE key length check in a
client, we need to wait for the next release of OpenSSL-1.0.2.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Michael Dawson
Shigeki Ohtsu
Adam Lippai
Fedor Indutny
Fedor Indutny
Michael Thomas
Lal Jérémy
Ryan Dahl
Theo Schlossnagle
Greg Hughes