@@ -408,6 +408,10 @@ Construct a new TLSSocket object from existing TCP socket.
408
408
409
409
- ` session ` : Optional, a ` Buffer ` instance, containing TLS session
410
410
411
+ - ` requestOCSP ` : Optional, if ` true ` - OCSP status request extension would
412
+ be added to client hello, and ` OCSPResponse ` event will be emitted on socket
413
+ before establishing secure communication
414
+
411
415
## tls.createSecurePair([ context] , [ isServer] , [ requestCert] , [ rejectUnauthorized] )
412
416
413
417
Stability: 0 - Deprecated. Use tls.TLSSocket instead.
@@ -508,6 +512,44 @@ NOTE: adding this event listener will have an effect only on connections
508
512
established after addition of event listener.
509
513
510
514
515
+ ### Event: 'OCSPRequest'
516
+
517
+ ` function (certificate, issuer, callback) { } `
518
+
519
+ Emitted when the client sends a certificate status request. You could parse
520
+ server's current certificate to obtain OCSP url and certificate id, and after
521
+ obtaining OCSP response invoke ` callback(null, resp) ` , where ` resp ` is a
522
+ ` Buffer ` instance. Both ` certificate ` and ` issuer ` are a ` Buffer `
523
+ DER-representations of the primary and issuer's certificates. They could be used
524
+ to obtain OCSP certificate id and OCSP endpoint url.
525
+
526
+ Alternatively, ` callback(null, null) ` could be called, meaning that there is no
527
+ OCSP response.
528
+
529
+ Calling ` callback(err) ` will result in a ` socket.destroy(err) ` call.
530
+
531
+ Typical flow:
532
+
533
+ 1 . Client connects to server and sends ` OCSPRequest ` to it (via status info
534
+ extension in ClientHello.)
535
+ 2 . Server receives request and invokes ` OCSPRequest ` event listener if present
536
+ 3 . Server grabs OCSP url from either ` certificate ` or ` issuer ` and performs an
537
+ [ OCSP request] to the CA
538
+ 4 . Server receives ` OCSPResponse ` from CA and sends it back to client via
539
+ ` callback ` argument
540
+ 5 . Client validates the response and either destroys socket or performs a
541
+ handshake.
542
+
543
+ NOTE: ` issuer ` could be null, if certficiate is self-signed or if issuer is not
544
+ in the root certificates list. (You could provide an issuer via ` ca ` option.)
545
+
546
+ NOTE: adding this event listener will have an effect only on connections
547
+ established after addition of event listener.
548
+
549
+ NOTE: you may want to use some npm module like [ asn1.js] to parse the
550
+ certificates.
551
+
552
+
511
553
### server.listen(port, [ host] , [ callback] )
512
554
513
555
Begin accepting connections on the specified ` port ` and ` host ` . If the
@@ -577,6 +619,16 @@ If `tlsSocket.authorized === false` then the error can be found in
577
619
` tlsSocket.authorizationError ` . Also if NPN was used - you can check
578
620
` tlsSocket.npnProtocol ` for negotiated protocol.
579
621
622
+ ### Event: 'OCSPResponse'
623
+
624
+ ` function (response) { } `
625
+
626
+ This event will be emitted if ` requestOCSP ` option was set. ` response ` is a
627
+ buffer object, containing server's OCSP response.
628
+
629
+ Traditionally, the ` response ` is a signed object from the server's CA that
630
+ contains information about server's certificate revocation status.
631
+
580
632
### tlsSocket.encrypted
581
633
582
634
Static boolean value, always ` true ` . May be used to distinguish TLS sockets
@@ -711,3 +763,5 @@ The numeric representation of the local port.
711
763
[ Forward secrecy ] : http://en.wikipedia.org/wiki/Perfect_forward_secrecy
712
764
[ DHE ] : https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
713
765
[ ECDHE ] : https://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman
766
+ [ asn1.js ] : http://npmjs.org/package/asn1.js
767
+ [ OCSP request ] : http://en.wikipedia.org/wiki/OCSP_stapling
0 commit comments