The OpenSSL library enforces security levels to control the minimum acceptable

level of security for cryptographic operations. OpenSSL's security levels range

from 0 to 5, with each level imposing stricter security requirements. The default

security level is 1, which is generally suitable for most modern applications.

However, some legacy features and protocols, such as TLSv1, require a lower

security level (`SECLEVEL=0`) to function properly. For more detailed information,

please refer to the [OpenSSL documentation on security levels][].

To adjust the security level in your Node.js application, you can include `@SECLEVEL=X`

within a cipher string, where `X` is the desired security level. For example,

to set the security level to 0 while using the default OpenSSL cipher list, you could use:

const tls = require('node:tls');

const port = 443;

tls.createServer({ciphers: 'DEFAULT@SECLEVEL=0', minVersion: 'TLSv1'}, function (socket) {

console.log('Client connected with protocol:', socket.getProtocol());

socket.end();

this.close();

}).

listen(port, () => {

tls.connect(port, {ciphers: 'DEFAULT@SECLEVEL=0', maxVersion: 'TLSv1'});

});

This approach sets the security level to 0, allowing the use of legacy features while still

leveraging the default OpenSSL ciphers.

You can also set the security level and ciphers from the command line using the

`--tls-cipher-list=DEFAULT@SECLEVEL=X` as described in [Modifying the default TLS cipher suite][].

However, it is generally discouraged to use the command line option for setting ciphers and it is

preferable to configure the ciphers for individual contexts within your application code,

as this approach provides finer control and reduces the risk of globally downgrading the security level.

interoperability. Versions before TLSv1.2 may require downgrading the [OpenSSL Security Level][].

Versions before TLSv1.2 may require downgrading the [OpenSSL Security Level][].

[OpenSSL Security Level]: #openssl-security-level

[OpenSSL documentation on security levels]: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_security_level.html#DEFAULT-CALLBACK-BEHAVIOUR