Force negotiation using TLSv1.0

[benbuckman]

As of 3/22/2016, the eBay API has several servers that can only negotiate TLS v1.0 sessions, and several servers that can negotiate TLS v1.0, v1.1 and v1.2. Node/OpenSSL get confused by this, and occasionally attempt to parse a v1.2 response using TLS v1.0 and vice versa. The error you get back from the request looks something like this:

{ [Error: write EPROTO 140113357338496:error:1408F10B:SSL
routines:SSL3_GET_RECORD:wrong version number:../deps/openssl/openssl/ssl/s3_pkt.c:362:
] code: 'EPROTO',
errno: 'EPROTO',
syscall: 'write' }

As far as I can tell, this isn't patched yet, in Node or OpenSSL. But setting the following options forces all connections to be negotiated with TLS v1.0, effectively fixing the issue.

More reading:

https://github.com/aws/aws-sdk-js/issues/862 https://github.com/nodejs/node/issues/3692 https://www.ssllabs.com/ssltest/analyze.html?d=api.ebay.com

If you know anyone at eBay, please tell them it's a) unacceptable to have servers that can only negotiate TLS v1.0, and b) unacceptable to have a SSL certificate that was signed with SHA1, and they should upgrade both things.

[benbuckman]

😢