Node.js encrypted network transport

TLS

These examples use the Node.js TLS transport. Start with TCP, then supply explicit certificates and verify the server identity. Add client identity when the server must know who connected.

Know what TLS proves

Encryption

Protects bytes in transit when negotiation and certificate verification succeed.

Server identity

A client verifies that the certificate chains to a trusted CA and matches the intended hostname.

Client identity

Server-authenticated TLS does not identify clients. Use mutual TLS or application credentials.

Match the implementation.

These examples describe the 14.x Node.js package. The Rust crate accepts an application-supplied verified Read + Write TLS stream and deliberately does not choose a cryptography stack. Certificate issuance, trust roots, hostname policy, client authentication, rotation, and production failure drills remain deployment-specific operator checks.

Open the Rust transport boundary →

Server with an explicit certificate

import {readFileSync} from 'node:fs';
import ipc from 'node-ipc';

ipc.config.id = 'secure-events';
ipc.config.networkHost = '127.0.0.1';
ipc.config.networkPort = 8443;
ipc.config.tls = {
  key: readFileSync(process.env.TLS_KEY_PATH),
  cert: readFileSync(process.env.TLS_CERT_PATH)
};

ipc.serveNet(() => {
  ipc.server.on('request', (data, socket) => {
    ipc.server.emit(socket, 'response', handle(data));
  });
});
ipc.server.start();

Keep keys outside the package and source tree. Main's intended server contract requires key and cert, or the file-path aliases private and public.

Client that verifies the server

import {readFileSync} from 'node:fs';
import ipc from 'node-ipc';

ipc.config.tls = {
  ca: readFileSync(process.env.TLS_CA_PATH),
  servername: 'ipc.internal.example'
};

ipc.connectToNet('secure-events', '10.0.0.8', 8443, () => {
  ipc.of['secure-events'].on('connect', () => {
    ipc.of['secure-events'].emit('request', {operation: 'status'});
  });
});

Do not turn verification off.

rejectUnauthorized: false accepts an unverified peer and enables man-in-the-middle attacks. Use it only in an isolated local experiment, never an untrusted network.

Mutual TLS

Server options

ipc.config.tls = {
  key: serverKey,
  cert: serverCert,
  ca: clientCA,
  requestCert: true,
  rejectUnauthorized: true
};

Client options

ipc.config.tls = {
  key: clientKey,
  cert: clientCert,
  ca: serverCA,
  servername: 'ipc.internal.example'
};

Certificate acceptance is only the first step. Map the verified client certificate to an application identity and authorization policy.

Deployment checklist

Issue certificates for the actual service hostname.
Trust only the required CA roots; rotate keys and certificates deliberately.
Never commit private keys, passphrases, or production certificates.
Test hostname mismatch, untrusted CA, expired certificate, missing client certificate, and successful mutual authentication.
Keep payload logs off unless data handling policy allows them.

← TCP UDP transport →