1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

doc: fix description of TLS dhparam option

Browse Source 
The dhparam option is not required for perfect forward secrecy in
general. It is only required for non-ECDHE secrecy, but ECDHE-based
secrecy is generally preferred anyway.

PR-URL: https://github.com/nodejs/node/pull/46949
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
This commit is contained in:
Tobias Nießen 2023-03-06 16:29:19 +01:00 committed by GitHub
parent 070e773abf
commit 00981eaf81
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/api/tls.md
View File

@ -1882,12 +1882,13 @@ changes:
client certificate.
* `crl` {string|string\[]|Buffer|Buffer\[]} PEM formatted CRLs (Certificate
Revocation Lists).
* `dhparam` {string|Buffer} Diffie-Hellman parameters, required for
* `dhparam` {string|Buffer} Diffie-Hellman parameters, required for non-ECDHE
[perfect forward secrecy][]. Use `openssl dhparam` to create the parameters.
The key length must be greater than or equal to 1024 bits or else an error
will be thrown. Although 1024 bits is permissible, use 2048 bits or larger
for stronger security. If omitted or invalid, the parameters are silently
discarded and DHE ciphers will not be available.
discarded and DHE ciphers will not be available. [ECDHE][]-based [perfect
forward secrecy][] will still be available.
* `ecdhCurve` {string} A string describing a named curve or a colon separated
list of curve NIDs or names, for example `P-521:P-384:P-256`, to use for
ECDH key agreement. Set to `auto` to select the