CODEWITHSUNDEEP
node.jsjson-rpc
kosta
kosta

Reputation: 4750

using correct SSL protocol when using client from node-json-rpc library

I am using this library https://www.npmjs.com/package/node-json-rpc to make client calls to https server exposing RPC apis.

However, when I run the code, I get this error

Error: SSLv3 methods disabled
    at new SecureContext (_tls_common.js:50:20)
    at Object.createSecureContext (_tls_common.js:89:13)
    at Object.connect (_tls_wrap.js:1120:48)
    at Agent.createConnection (https.js:119:22)
    at Agent.createSocket

My code is

var rpc = require('node-json-rpc');

var options = {
      port: 443,
      host: 'mynode',
      path: '/rpc',
      strict: true,
      ssl: {
        // protocol: 'TLSv1.2'
      }

    };

this.client = new rpc.Client(options);

this.client.call(
          {"jsonrpc": "2.0", "method": "txpool_content", "params": [], "id": 1},
          function (err, res) {
            if( err ) {
                resolve(null);
            }
            else {
                resolve(res.result);
            }
          }
        );

I made sure that this api works from Postman with this endpoint https://mynode/rpc

I understand that this protocol SSLv3 might be disabled for node js, but I don't find any other options in the documentation. I don't have the cert and the key.

Upvotes: 0

Views: 1903

Answers (1)

We Are All Monica
We Are All Monica

Reputation: 13344

From the library code (node_modules/node-json-rpc/lib/rpcclient.js):

if (conf.ssl) {
  options.servername = conf.ssl.sniName || 'RPC-Server';
  options.secureProtocol = conf.ssl.protocol || 'SSLv3_client_method';
  ...

So, it looks like you can set { ssl: { protocol: 'something' } } in your options.

What is that something? Let's go looking through the Node.js docs:

https://nodejs.org/api/https.html:

The following additional options from tls.connect() are also accepted: ... secureProtocol ...

https://nodejs.org/api/tls.html#tls_tls_connect_options_callback:

secureProtocol <string> Optional SSL method to use. The possible values are listed as SSL_METHODS, use the function names as strings. For example, 'TLSv1_2_method' to force TLS version 1.2

The example they give would be a good place to start, but that page also links to a full list of the available SSL methods: https://www.openssl.org/docs/man1.1.0/ssl/ssl.html#Dealing-with-Protocol-Methods

Upvotes: 1

Related Questions