Node.js · Module

node:tls

The node:tls module provides OpenSSL-backed TLS and SSL networking for Node.js clients and servers. It includes encrypted sockets, TLS servers, secure contexts, certificate handling, and protocol inspection.

How it works

The node:tls module builds encrypted client and server communication on OpenSSL. It exposes secure sockets, servers, contexts, certificate and cipher inspection, and connection helpers; a client connection negotiates TLS before application data is exchanged.

Syntax

import tls from 'node:tls';
const tls = require('node:tls');

Returns

The module exports TLS client and server APIs, secure-context utilities, TLS socket and server classes, constants, and inspection functions.

Key points

Use this module when Node.js code needs TLS or SSL communication.
Node.js delegates the underlying cryptographic protocol implementation to OpenSSL.
Certificates and keys provide the trust and identity model used by TLS connections.
Import it as node:tls in ESM or load it with require('node:tls') in CommonJS.
After setup, the TLS socket handles encryption and protocol negotiation beneath ordinary stream writes.

Common mistakes

A build without node:crypto support cannot import or require node:tls.
Changing the cipher string changes security behavior, so avoid weakening the configured level without a deliberate compatibility reason.

Example: Connect with TLS

import tls from 'node:tls';

const socket = tls.connect({ host: 'example.com', port: 443, servername: 'example.com' }, () => {
  console.log('TLS version:', socket.getProtocol());
  socket.end();
});

socket.on('error', console.error);

Opens a TLS connection to an HTTPS endpoint, reports the negotiated protocol after the handshake, and closes the socket.

When to use it

TLS client connections

A backend must call an HTTPS-compatible service directly over an encrypted transport.

Secure TCP servers

An application accepts encrypted inbound TCP connections with server certificates.

Reusable TLS contexts

Several connections share certificate, key, CA, or protocol configuration.

TLS connection inspection

Operations or diagnostics need negotiated protocol, cipher, or peer-certificate information.

Interview questions

QHow does a Node.js TLS client establish a connection?

tls.connect() creates a client-side TLS connection and returns a tls.TLSSocket. It can receive host, port, certificate, authentication, and protocol options, and its callback runs when the connection is ready.

Follow-up: How can the peer certificate be inspected? Use the connected socket's certificate inspection APIs, such as getPeerCertificate(), after the connection is established.

QWhat is the purpose of a secure context?

tls.createSecureContext() builds reusable TLS credentials and configuration. A context can be supplied to server or client APIs so certificate, key, CA, and related settings are centralized.

Follow-up: What happens if a required certificate key is absent? Certificate-based cipher configurations require a key, supplied directly or through a PFX.

QWhat is a TLSSocket?

tls.TLSSocket extends net.Socket while adding TLS negotiation and transparent encryption. It therefore participates in stream-style I/O while exposing TLS-specific state and inspection methods.

Follow-up: How can negotiated protocol details be checked? Call connection inspection methods such as getProtocol() after the handshake has completed.

tls.connect()
tls.createServer()
tls.createSecureContext()
tls.TLSSocket
tls.Server
tls.getCiphers()
tls.DEFAULT_MIN_VERSION
tls.DEFAULT_MAX_VERSION

Source: TLS (SSL) | Node.js v26.11.1 Documentation. Checked 2026-10-15.