Commit b61e682fc02 for nodejs
commit b61e682fc02c6b3bec27d8ade24d3affb04f1436
Author: Filip Skokan <panva.ip@gmail.com>
Date: Wed Aug 26 23:57:30 2026 +0200
Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183)"
This reverts commit da516920fc3b091e54af21a86677574270803b81.
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 6e0250f2e86..63b85c8ca70 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -6606,9 +6606,6 @@ added: v15.6.0
<!-- YAML
added: v0.11.11
changes:
- - version: REPLACEME
- pr-url: https://github.com/nodejs/node/pull/63966
- description: Runtime deprecation.
- version:
- v22.4.0
- v20.16.0
@@ -6616,14 +6613,11 @@ changes:
description: Custom engine support in OpenSSL 3 is deprecated.
-->
-> Stability: 0 - Deprecated
-
* `engine` {string}
* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
Load and set the `engine` for some or all OpenSSL functions (selected by flags).
-Use of this API is deprecated because custom engine support has been deprecated
-since OpenSSL 3.
+Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
`engine` could be either an id or a path to the engine's shared library.
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 9642da384ac..6c9fcecf319 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4111,9 +4111,6 @@ that are shorter than the default authentication tag length (i.e., shorter than
<!-- YAML
changes:
- - version: REPLACEME
- pr-url: https://github.com/nodejs/node/pull/63966
- description: Runtime deprecation.
- version:
- v22.4.0
- v20.16.0
@@ -4121,7 +4118,7 @@ changes:
description: Documentation-only deprecation.
-->
-Type: Runtime
+Type: Documentation-only
OpenSSL 3 has deprecated support for custom engines with a recommendation to
switch to its new provider model. The `clientCertEngine` option for
diff --git a/doc/api/https.md b/doc/api/https.md
index eba303b6600..74b759556c4 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -427,9 +427,6 @@ a `timeout` of 5 seconds.
<!-- YAML
added: v0.3.6
changes:
- - version: REPLACEME
- pr-url: https://github.com/nodejs/node/pull/63966
- description: The `clientCertEngine` option is runtime deprecated.
- version:
- v22.4.0
- v20.16.0
diff --git a/doc/api/tls.md b/doc/api/tls.md
index 7e010f4c34e..d518289d493 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1988,10 +1988,6 @@ argument.
<!-- YAML
added: v0.11.13
changes:
- - version: REPLACEME
- pr-url: https://github.com/nodejs/node/pull/63966
- description: The `clientCertEngine`, `privateKeyEngine` and
- `privateKeyIdentifier` options are runtime deprecated.
- version:
- v26.4.0
- v24.19.0
@@ -2216,9 +2212,6 @@ permissible, use 2048 bits or larger for stronger security.
<!-- YAML
added: v0.3.2
changes:
- - version: REPLACEME
- pr-url: https://github.com/nodejs/node/pull/63966
- description: The `clientCertEngine` option is runtime deprecated.
- version:
- v22.4.0
- v20.16.0
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 1a49c6f4083..f915b103db4 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -96,7 +96,6 @@ const { Buffer } = require('buffer');
const {
emitExperimentalWarning,
filterDuplicateStrings,
- getDeprecationWarningEmitter,
lazyDOMException,
setOwnProperty,
} = require('internal/util');
@@ -213,11 +212,6 @@ const getMacs = cachedArrayByFipsGeneration(
const getCurves = cachedArrayByFipsGeneration(
() => filterDuplicateStrings(_getCurves()));
-const emitOpenSSLEngineDeprecation = getDeprecationWarningEmitter(
- 'DEP0183',
- 'OpenSSL engine-based APIs are deprecated.',
-);
-
function setEngine(id, flags) {
validateString(id, 'id');
if (flags)
@@ -228,8 +222,6 @@ function setEngine(id, flags) {
if (flags === 0)
flags = ENGINE_METHOD_ALL;
- emitOpenSSLEngineDeprecation();
-
if (typeof _setEngine !== 'function')
throw new ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED();
if (!_setEngine(id, flags))
@@ -1286,7 +1278,6 @@ module.exports = {
getHashes,
getMacs,
getOptionalByteLength,
- emitOpenSSLEngineDeprecation,
kHandle,
setEngine,
toBuf,
diff --git a/lib/internal/tls/secure-context.js b/lib/internal/tls/secure-context.js
index 597d4fce927..862d7501a1d 100644
--- a/lib/internal/tls/secure-context.js
+++ b/lib/internal/tls/secure-context.js
@@ -34,7 +34,6 @@ const {
} = require('internal/validators');
const {
- emitOpenSSLEngineDeprecation,
toBuf,
} = require('internal/crypto/util');
@@ -270,7 +269,6 @@ function configSecureContext(context, options = kEmptyObject, name = 'options')
if (typeof privateKeyIdentifier === 'string' &&
typeof privateKeyEngine === 'string') {
- emitOpenSSLEngineDeprecation();
if (context.setEngineKey)
context.setEngineKey(privateKeyIdentifier, privateKeyEngine);
else
@@ -332,7 +330,6 @@ function configSecureContext(context, options = kEmptyObject, name = 'options')
}
if (typeof clientCertEngine === 'string') {
- emitOpenSSLEngineDeprecation();
if (typeof context.setClientCertEngine !== 'function')
throw new ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED();
else
diff --git a/test/addons/openssl-client-cert-engine/test.js b/test/addons/openssl-client-cert-engine/test.js
index bad751202ca..77fef53e84f 100644
--- a/test/addons/openssl-client-cert-engine/test.js
+++ b/test/addons/openssl-client-cert-engine/test.js
@@ -26,12 +26,6 @@ const agentKey = fs.readFileSync(fixture.path('/keys/agent1-key.pem'));
const agentCert = fs.readFileSync(fixture.path('/keys/agent1-cert.pem'));
const agentCa = fs.readFileSync(fixture.path('/keys/ca1-cert.pem'));
-common.expectWarning({
- DeprecationWarning: {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
const serverOptions = {
key: agentKey,
cert: agentCert,
diff --git a/test/addons/openssl-key-engine/test.js b/test/addons/openssl-key-engine/test.js
index db05b6cea62..187f95b5141 100644
--- a/test/addons/openssl-key-engine/test.js
+++ b/test/addons/openssl-key-engine/test.js
@@ -26,12 +26,6 @@ const agentKey = fs.readFileSync(fixture.path('/keys/agent1-key.pem'));
const agentCert = fs.readFileSync(fixture.path('/keys/agent1-cert.pem'));
const agentCa = fs.readFileSync(fixture.path('/keys/ca1-cert.pem'));
-common.expectWarning({
- DeprecationWarning: {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
const serverOptions = {
key: agentKey,
cert: agentCert,
diff --git a/test/parallel/test-crypto-dep0183.js b/test/parallel/test-crypto-dep0183.js
deleted file mode 100644
index c0b9a8e9f67..00000000000
--- a/test/parallel/test-crypto-dep0183.js
+++ /dev/null
@@ -1,22 +0,0 @@
-'use strict';
-
-const common = require('../common');
-if (!common.hasCrypto)
- common.skip('missing crypto');
-
-const assert = require('assert');
-const crypto = require('crypto');
-
-common.expectWarning({
- DeprecationWarning: {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
-assert.throws(
- () => crypto.setEngine('nodejs-test-invalid-engine'),
- (err) => {
- return err.code === 'ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED' ||
- err.code === 'ERR_CRYPTO_ENGINE_UNKNOWN';
- },
-);
diff --git a/test/parallel/test-tls-clientcertengine-unsupported.js b/test/parallel/test-tls-clientcertengine-unsupported.js
index aa0bf4a18d6..0d24005dc0a 100644
--- a/test/parallel/test-tls-clientcertengine-unsupported.js
+++ b/test/parallel/test-tls-clientcertengine-unsupported.js
@@ -6,15 +6,6 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
-
-common.expectWarning({
- 'internal/test/binding':
- 'These APIs are for internal testing only. Do not use them.',
- 'DeprecationWarning': {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
// Monkey-patch SecureContext
const { internalBinding } = require('internal/test/binding');
const binding = internalBinding('crypto');
diff --git a/test/parallel/test-tls-error-stack.js b/test/parallel/test-tls-error-stack.js
index 0a952a46bdd..02021b060ec 100644
--- a/test/parallel/test-tls-error-stack.js
+++ b/test/parallel/test-tls-error-stack.js
@@ -8,19 +8,12 @@ if (!common.hasCrypto)
const assert = require('assert');
const tls = require('tls');
-const secureContext = tls.createSecureContext();
-if (typeof secureContext.context.setClientCertEngine !== 'function')
- common.skip('OpenSSL dropped engine support');
-
-common.expectWarning({
- DeprecationWarning: {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
assert.throws(() => {
tls.createSecureContext({ clientCertEngine: 'x' });
}, (err) => {
+ if (err.code === 'ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED')
+ common.skip('OpenSSL dropped engine support');
+
return err.name === 'Error' &&
/could not load the shared library/.test(err.message) &&
Array.isArray(err.opensslErrorStack) &&
diff --git a/test/parallel/test-tls-keyengine-unsupported.js b/test/parallel/test-tls-keyengine-unsupported.js
index 3473fe533f2..5fcfe495d51 100644
--- a/test/parallel/test-tls-keyengine-unsupported.js
+++ b/test/parallel/test-tls-keyengine-unsupported.js
@@ -6,15 +6,6 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
-
-common.expectWarning({
- 'internal/test/binding':
- 'These APIs are for internal testing only. Do not use them.',
- 'DeprecationWarning': {
- DEP0183: 'OpenSSL engine-based APIs are deprecated.',
- },
-});
-
// Monkey-patch SecureContext
const { internalBinding } = require('internal/test/binding');
const binding = internalBinding('crypto');