Update tls.md

[tgerk]

tls.createServer() and new tls.Server() ignore secureContext option

[Trott]

@nodejs/crypto @nodejs/http Putting aside formatting for a moment, is the content of this addition correct?

[tgerk]

Yes, as of version 18.12.1. In brief, secureContext exists only to tls.Socket constructor options, not tls.Server.

I'm writing an FTP service that constructs a new TLS server for the data channel for each client session and believed there was some optimization in creating secureContext once. The documentation error, at least, needs to be fixed.

I reviewed source code to confirm. /lib/_tls_wrap.js line 1211 passes the whole tls.Server constructor options object to tls.Server.setSecureContext(). Those options are masticated and passed to tls.createSecureContext() to initialize tls.Server._sharedCreds. It's this property that is passed in secureContext option when constructing tls.Socket, same file line 1096 in function tlsConnectionListener

I'm not sure this is the correct or complete resolution. It's surprising that tls.Server options validation does not fail. The client error when connecting to a server constructed with secureContext fails cryptically: "Error: Client network socket disconnected before secure TLS connection was established"

[tgerk]

Putting aside formatting for a moment

Totally agree--I had a vague hope the github editor would apply lint, pretty, etal on commit.

[Trott]

Putting aside formatting for a moment

Totally agree--I had a vague hope the github editor would apply lint, pretty, etal on commit.

Yeah, no problem there, I'm happy to fix the formatting etc. I just want confirmation from the relevant subsystem maintainers that the information is correct and complete, this is not a bug, etc.

[lpinca]

I think f11f180 meant tls.connect() instead of tls.createServer(). See also 96a986d.

[nodejs-github-bot]

Landed in 6ecbd57