Skip to main content
Version: v0.0.3

Interface: TlsOptions

Client-side TLS options (ClientOptions.tls).

Passing true for ClientOptions.tls is equivalent to {}, TLS enabled with all defaults, including certificate verification on.

Example​

import { createClient } from '@cosyte/mllp';
const client = createClient({
  host: 'mllp.example.com',
  port: 2575,
  tls: { ca: caPem, minVersion: 'TLSv1.2' },
});

Properties​

allowUnverified?​

readonly optional allowUnverified?: boolean

Loud, explicit dev opt-out from certificate verification (maps to tls.connect's rejectUnauthorized: false). There is deliberately no raw rejectUnauthorized surface on this type, this is the only door, and it is loud: every successful connection (initial + every reconnect) emits a 'securityWarning' (MLLP_TLS_VERIFY_DISABLED) event and calls process.emitWarning.

Never set this in production against an untrusted network.

Default​

false

ca?​

readonly optional ca?: PemInput

Trust anchor(s) for verifying the server's certificate chain.

cert?​

readonly optional cert?: PemInput

Client certificate presented for mutual TLS (ATNA ITI-19).

ciphers?​

readonly optional ciphers?: string

OpenSSL cipher-list string passthrough (tls.connect's ciphers). Unset uses Node's compiled-in defaults, which already include both ATNA-mandated ECDHE suites (see the module doc comment). Set this to restrict to a stricter list (e.g. DHE suites) if your deployment requires it.

Default​

undefined (Node defaults)

key?​

readonly optional key?: PemInput

Private key matching TlsOptions.cert.

maxVersion?​

readonly optional maxVersion?: "TLSv1.2" | "TLSv1.3"

Maximum negotiated TLS protocol version.

minVersion?​

readonly optional minVersion?: "TLSv1.2" | "TLSv1.3"

Minimum negotiated TLS protocol version.

Default 'TLSv1.2', the IHE ATNA ITI-19 "TLS 1.2 Floor" (BCP195) floor (ITI TF-2 §3.19.6.2.3). 'TLSv1.0'/'TLSv1.1' are intentionally not expressible by this type, the floor cannot be lowered through this API.

Default​

'TLSv1.2'

passphrase?​

readonly optional passphrase?: string

Passphrase for an encrypted TlsOptions.key.

servername?​

readonly optional servername?: string

SNI hostname and the identity-check target (matched against the server certificate's Subject/SAN). Defaults to ClientOptions.host when unset.