# ssl-config

> Allows you to specify SSL/TLS cipher suites based on both security and browser compatibility.

Latest version **1.0.0** (published 2016-09-15) · MPL-2.0 license · 0 weekly downloads

## Install

```sh
npm install ssl-config
pnpm add ssl-config
yarn add ssl-config
bun add ssl-config
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.0 |
| Published | 2016-09-15 |
| First published | 2015-03-29 |
| Weekly downloads | 0 |
| License | MPL-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=0.12 |
| Dependencies | 3 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 50 |
| Author | Mike MacCana |
| Maintainers | mikemaccana |
| Keywords | tls, ssl, browser |

## Links

- npm: https://www.npmjs.com/package/ssl-config
- Repository: https://github.com/mikemaccana/ssl-config
- Issues: https://github.com/mikemaccana/ssl-config/issues
- npm.io page: https://npm.io/package/ssl-config

## Dependencies (3)

- [assert](https://npm.io/package/assert.md) ^1.3.0
- [es6-shim](https://npm.io/package/es6-shim.md) ^0.27.1
- [minimum-tls-version](https://npm.io/package/minimum-tls-version.md) 0.0.1

## Alternatives

- [@opentelemetry/exporter-zipkin](https://npm.io/package/@opentelemetry/exporter-zipkin.md) — 14.8M weekly downloads
- [pusher-js](https://npm.io/package/pusher-js.md) — 2.0M weekly downloads
- [browserify](https://npm.io/package/browserify.md) — 1.7M weekly downloads
- [sqs-consumer](https://npm.io/package/sqs-consumer.md) — 1.7M weekly downloads
- [@sanity/eventsource](https://npm.io/package/@sanity/eventsource.md) — 930.8K weekly downloads

## Recent versions

- 1.0.0 (latest) — 2016-09-15
- 0.0.9 — 2015-06-01
- 0.0.8 — 2015-04-12
- 0.0.7 — 2015-03-30
- 0.0.5 — 2015-03-29
- 0.0.3 — 2015-03-29
- 0.0.2 — 2015-03-29
- 0.0.1 — 2015-03-29

## README

# SSL Config

A node.js implementation of the recommended cipher suites and TLS/SSL versions from Mozilla's [Server Side TLS](https://github.com/mozilla/server-side-tls) project.

The suite list uses [the cipher suite prioritization logic from Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS#Prioritization_logic). Since [Firefox](https://www.ssllabs.com/ssltest/viewClient.html?name=Firefox&version=35&platform=OS%20X) and [Chrome](https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&version=40&platform=OS%20X) don't support AES-GCM with 256 bit keys, a 128 bit AES key is considered superior.

Note **this package only sets cipher suites and TLS/SSL versions**, other parts of the recommendations are implemented elsewhere, eg, for Express servers HSTS we recommend using [Helmet](https://www.npmjs.com/package/helmet).

## Usage

Just use either 'modern', 'intermediate' or 'old'.

### modern

Requires IE 11, Firefox 27, Chrome 22, Safari 7, Android 4.4, Opera 14, Java 8 or newer.

### intermediate

Requires IE 7, Firefox 1, Chrome 1, Safari 1, Windows XP IE8, Android 2.3, Opera 5, Java 7 or newer.

### old

Windows XP IE6, Java 6 and newer. You really shouldn't use this setting, it is implemented for compatibility with Mozilla's tools.

Eg:

	var sslConfig = require('ssl-config')('modern');

Then run `https.createServer` per [node.js TLS](https://nodejs.org/api/tls.html) and [io.js TLS](https://iojs.org/api/tls.html#tls_tls_createserver_options_secureconnectionlistener) docs.

	https.createServer({
		key: privateKey,
		cert: certificate,
		ca: certificateAuthority,
		ciphers: sslConfig.ciphers,
		honorCipherOrder: true,
		secureOptions: sslConfig.minimumTLSVersion
	});

Or for express.js

	var server = https.createServer({
		key: privateKey,
		cert: certificate,
		ca: certificateAuthority,
		ciphers: sslConfig.ciphers,
		honorCipherOrder: true,
		secureOptions: sslConfig.minimumTLSVersion
	}, app);

Or for [Hapi](http://hapijs.com/):

```
var server = new Hapi.Server();
server.connection({
  // other config options here
  tls: {
    key: privateKey,
    cert: certificate,
    ca: certificateAuthority,
    ciphers: sslConfig.ciphers,
    honorCipherOrder: true,
    secureOptions: sslConfig.minimumTLSVersion
  },
  routes: {
    security: true // turns on HSTS and other security headers
  }
});
```

## License

Mozilla Public License 2.0

---
_Source: https://npm.io/package/ssl-config · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._