-
Notifications
You must be signed in to change notification settings - Fork 30.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Expose whether a TLS server requested a client certificate #29882
Comments
@nodejs/crypto |
There are a couple of issues here that make it less straightforward than what's requested:
Adding a |
Would it be possible to see it on successful handshakes and also after error events? That's how If Being able to read it only in successful cases would still be useful to me, but both cases is definitely better. |
Up to a point. If the handshake never gets to the ServerHello stage, there's no way to tell. Session resumption or session tickets also seem to prevent node/openssl from knowing whether there was originally a client certificate request. I made a quick attempt using |
I've poked at this some more and I don't see a good, reliable way to make it work. I'm going to close this out as a wontfix but you're still welcome to send a PR if you can make it work. I toyed with the idea of implementing a custom ServerHello parser like we do for ClientHellos (to perform async session resumption, something openssl doesn't support) but I'm not convinced the complexity/payoff trade-off is worth it for just this particular feature. |
Yeah ok, fair enough. It's a shame, but this makes sense and I'll survive without it. Thanks for trying anyway! |
Is your feature request related to a problem? Please describe.
I'm making TLS connections to various servers, and for both successful & failing connections I want to know whether the servers requested a client certificate.
For context: my app is an MITM proxy, and I want to be able to warn the downstream user when they might want to configure a client certificate.
Describe the solution you'd like
I'd like a way to know whether the server requested a client cert during the handshake. This is data that's received by node (or at least, by OpenSSL) alongside the initial hello, but it's not exposed in any way that I can see.
There's also probably other handshake metadata that would be interesting to expose too, which might be worth considering in future, but nothing that's immediately useful to me right this second.
A
handshakeStarted
event on sockets that exposes the data received from the server for inspection would work, for example, or alternatively atlsSocket.clientCertificateRequested
boolean would be fine too (as long as its available regardless of subsequent errors).Describe alternatives you've considered
As far as I can tell, there's no way to do this right now other than manually collecting the entire TLS handshake data myself and parsing it from scratch in JS. That sounds like an major undertaking, and significant duplication of work since node is clearly parsing this data already.
For servers that outright reject connections without certificates it might be possible to infer the cause from the error details, but that's a limited case and not reliable. Discussed on SO too, with no useful result as yet: https://stackoverflow.com/questions/58283656/how-to-tell-if-a-tls-server-requested-a-client-certificate
The text was updated successfully, but these errors were encountered: