node.js SSL encryption without authentication

Question

When a client connects to a node.js SSL server and is not authenticated, i.e.:

server doesn't require it, i.e. uses requestCert: false
or client certificate is "wrong", i.e. the secureConnection event is fired on the SSL server but Cleartextstream.authorized is false

Is the communication between the client and the server still encrypted (authentication and confidentiality being two different things)?

Another way to put it: does node.js SSL server falls back as a normal/unencrypted TCP server if there are authentication problems, but still fires a secureConnection event?

alex · Accepted Answer · 2014-02-23 13:44:35Z

1

Communication between the client and the server is always encrypted if you're using SSL server. So if somebody captures your traffic, he won't be able to read it (but you make MitM attack easier).

But why do you asking it here, if you can simply check the traffic using Wireshark?

answered Feb 23, 2014 at 13:44

alex

12.3k3 gold badges33 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ehmicky Over a year ago

Good point for Wireshark. I guess my question was more: does node.js SSL server behaves like a normal TCP server if there are authentication problems?

alex Over a year ago

it behaves like a normal SSL server... you can check it with openssl s_client by the way

Collectives™ on Stack Overflow

node.js SSL encryption without authentication

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related