TlsTransportOptionsType

TlsTransportOptionsType = object

Defined in: src/runtime/tcp/TcpBackend.ts:23

Runtime-neutral TCP transport abstraction consumed by TcpTransport.

Each of Bun / Node.js / Deno exposes TCP with a slightly different API shape (Bun’s callback-based Bun.listen, Node’s EventEmitter-based node:net, Deno’s async-iterable-based Deno.listen). TcpBackend hides the differences so the cluster transport only deals with TcpSocketLike values and a small set of callbacks.

TLS: the tls field on listen/connect carries a runtime-neutral shape; each adapter maps it to the corresponding native configuration. Bun and Node share most field names (cert, key, ca, requestCert/requestClientCert, rejectUnauthorized); Deno wraps everything in its Deno.listenTls / Deno.connectTls shape.

Every certificate field carries the material itself, never a path to it — no layer here or below reads from disk, and none of the three runtimes accepts a filename in these fields either. Load it yourself (readFileSync(path, 'utf8'), a mounted secret, a KMS fetch) and pass what you loaded.

Properties

ca?

readonly optional ca?: string | Uint8Array

Defined in: src/runtime/tcp/TcpBackend.ts:36

Trusted CA bundle — for client-auth validation and peer-cert validation.

---

cert?

readonly optional cert?: string | Uint8Array

Defined in: src/runtime/tcp/TcpBackend.ts:32

Server certificate — PEM contents or DER bytes, not a file path.

On a listener this is mandatory whenever tls is supplied at all, and so is key: see assertListenerTlsIsCoherent. On an outbound dial it is the client certificate, and omitting it is ordinary — that is one-way TLS, where only the server is authenticated.

---

key?

readonly optional key?: string | Uint8Array

Defined in: src/runtime/tcp/TcpBackend.ts:34

Private key matching cert — PEM contents or DER bytes, not a file path.

---

rejectUnauthorized?

readonly optional rejectUnauthorized?: boolean

Defined in: src/runtime/tcp/TcpBackend.ts:46

Reject outbound connections whose cert isn’t signed by ca. Default: true.

---

requestClientCert?

readonly optional requestClientCert?: boolean

Defined in: src/runtime/tcp/TcpBackend.ts:44

Require clients to present a valid cert signed by ca (server-side).

Defaults to ca !== undefined, not to false: supplying a trust bundle to a cluster listener has no other purpose than verifying the peers that connect to it. See requiresClientCertificate.

---

serverName?

readonly optional serverName?: string

Defined in: src/runtime/tcp/TcpBackend.ts:48

Override SNI hostname sent on outbound connects.