Skip to content

Commit ddc5afd

Browse files
mildsunriselundibundi
authored andcommitted
doc: warn that tls.connect() doesn't set SNI
Add a note warning users that when using tls.connect(), the `servername` option must be set explicitely to enable SNI, otherwise the connection could fail. PR-URL: #33855 Fixes: #28167 Co-authored-by: Denys Otrishko <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Denys Otrishko <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
1 parent d77eaee commit ddc5afd

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

doc/api/tls.md

+6
Original file line numberDiff line numberDiff line change
@@ -1392,6 +1392,12 @@ The `callback` function, if specified, will be added as a listener for the
13921392

13931393
`tls.connect()` returns a [`tls.TLSSocket`][] object.
13941394

1395+
Unlike the `https` API, `tls.connect()` does not enable the
1396+
SNI (Server Name Indication) extension by default, which may cause some
1397+
servers to return an incorrect certificate or reject the connection
1398+
altogether. To enable SNI, set the `servername` option in addition
1399+
to `host`.
1400+
13951401
The following illustrates a client for the echo server example from
13961402
[`tls.createServer()`][]:
13971403

0 commit comments

Comments
 (0)