SSL routines:final_renegotiate:unsafe legacy renegotiation disabled

[shikha-sri]

Hi All,

We are using Node v17.9.0.
We have a function using GOT streams to copy file to a server. We have set

1. 'rejectUnauthorized : false'
2. NODE_TLS_REJECT_UNAUTHORIZED=0
3. 'minVersion': 'TLSv1.2'
4. 'ecdhCurve':"auto"

Getting below error in logs-

Error: write EPROTO C047BFCB1D7F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:908:
shikha-runn-1 |
shikha-runn-1 | at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:94:16)
shikha-runn-1 | "message": "write EPROTO C047BFCB1D7F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:908:\n",
shikha-runn-1 | "errno": -71,
shikha-runn-1 | "code": "EPROTO",
shikha-runn-1 | "syscall": "write"

Any leads would be highly appreciated.
Thanks!!

[iTim314]

Chiming in to say that I need a solution for this as well. The API I'm trying to reach is using unsafe legacy renegotiation and I have no way around it. Other HTTP libraries have a way to pass something like secureOptions: crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT but I can't seem to figure out how to implement this with got.

[vijay-koppala]

#2271 (comment)

[sindresorhus]

This error occurs becuase the server you're connecting to uses unsafe legacy SSL renegotiation, which is disabled by default in newer Node.js versions for security reasons.

You can enable it using the https.secureOptions option with Got:

import https from 'https';
import got from 'got';

await got('https://example.com', {
	https: {
		secureOptions: https.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
	}
});

For streams, it works the same way:

const stream = got.stream('https://example.com', {
	https: {
		secureOptions: https.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
	}
});

Note that this re-enables unsafe legacy renegotiation, which has security implications. Ideally, the server should be updated to support secure renegotiation, but this workaround will get you unblocked in the meantime.