Interface: ServerTlsOptions

Server-side TLS options (ServerOptions.tls).

Example

import { createServer } from '@cosyte/mllp';
const server = createServer({
  tls: { cert: certPem, key: keyPem, clientAuth: 'MUST', ca: clientCaPem },
});

Properties

ca?

readonly optional ca?: PemInput

Trust anchor(s) for verifying client certificates under WANT/MUST.

---

cert

readonly cert: PemInput

Server certificate (PEM). Required.

---

ciphers?

readonly optional ciphers?: string

OpenSSL cipher-list string passthrough. Unset uses Node's defaults (includes both ATNA-mandated ECDHE suites).

Default

undefined (Node defaults)

---

clientAuth?

readonly optional clientAuth?: ClientAuth

ATNA ITI-19 mutual-authentication mode. 'WANT' requests a client certificate without rejecting unauthorized/absent ones (surfaced, not enforced); 'MUST' requests AND enforces verification (ATNA mutual auth). See ClientAuth.

Default

'NONE'

---

key

readonly key: PemInput

Private key matching ServerTlsOptions.cert. Required.

---

maxVersion?

readonly optional maxVersion?: "TLSv1.2" | "TLSv1.3"

Maximum negotiated TLS protocol version.

---

minVersion?

readonly optional minVersion?: "TLSv1.2" | "TLSv1.3"

Minimum negotiated TLS protocol version, the IHE ATNA ITI-19 "TLS 1.2 Floor" (BCP195) floor (ITI TF-2 §3.19.6.2.3).

Default

'TLSv1.2'

---

passphrase?

readonly optional passphrase?: string

Passphrase for an encrypted ServerTlsOptions.key.