test(tls): expand granular Node parity coverage

test-parity/node-suite/tls/README.md

@@ -0,0 +1,57 @@
+# `node:tls` granular parity coverage
+
+This directory contains independent print-and-diff fixtures for the TLS API. The
+Node oracle is the repository-pinned Node.js 26.5.0. Network cases use only
+`127.0.0.1`, bind port `0`, and use the fixed non-secret certificate material in
+`fixtures/`; they do not consult internet endpoints or host trust stores.
+
+## Upstream audit
+
+The expansion was checked against these primary sources:
+
+- Node.js 26.5.0 (`bebd1b8d92bf4cc917844d6335ed1ecf9c2a75fb`): the 241 TLS-named cases under [`test/parallel`](https://github.com/nodejs/node/tree/v26.5.0/test/parallel) and [`test/sequential`](https://github.com/nodejs/node/tree/v26.5.0/test/sequential), especially `test-tls-basic-validations.js`, `test-tls-check-server-identity.js`, `test-tls-connect-simple.js`, `test-tls-getcipher.js`, `test-tls-getprotocol.js`, `test-tls-peer-certificate.js`, `test-tls-alpn-server-client.js`, `test-tls-sni-server-client.js`, `test-tls-secure-session.js`, and `test-tls-ticket-invalid-arg.js`.
+- Deno `e6a0143641690dfb2723bab3ce97c394d5ea3ec3`: the current Node compatibility selections in [`tests/node_compat/config.jsonc`](https://github.com/denoland/deno/blob/e6a0143641690dfb2723bab3ce97c394d5ea3ec3/tests/node_compat/config.jsonc) and the implementation in [`ext/node/polyfills/tls_esm.ts`](https://github.com/denoland/deno/blob/e6a0143641690dfb2723bab3ce97c394d5ea3ec3/ext/node/polyfills/tls_esm.ts).
+- Bun `4bbe0751a2e5436757768325c2cc7ed97dc8767c`: its current dedicated [`test/js/node/tls`](https://github.com/oven-sh/bun/tree/4bbe0751a2e5436757768325c2cc7ed97dc8767c/test/js/node/tls) cases and selected Node TLS tests under [`test/js/node/test/parallel`](https://github.com/oven-sh/bun/tree/4bbe0751a2e5436757768325c2cc7ed97dc8767c/test/js/node/test/parallel).
+
+The local cases reduce those larger suites to deterministic semantic probes for
+exports/classes/constants, secure-context and option validation, certificate and
+hostname identity, loopback handshake/event cleanup, socket getters, ALPN, SNI,
+TLS 1.2 session resumption, ticket keys, and fragment-size controls.
+
+## Build-mode diagnostic
+
+A direct `node:tls` import currently exposes two separate build paths:
+
+1. Auto-optimization attempts to rebuild `perry-stdlib` and fails at
+   `crates/perry-stdlib/src/tls.rs` because `rustls::crypto::ring` is referenced
+   while rustls's `ring` feature is not activated.
+2. Without matched static fallback archives, compilation then reports missing
+   `libperry_runtime.a`. With `PERRY_RUNTIME_DIR=target/perry-dev` after building
+   `perry-runtime-static` and `perry-stdlib-static`, fixtures reach the behavioral
+   lane. Some socket cases then expose a separate link failure for the undefined
+   `_js_net_socket_once` symbol.
+
+These are feature/archive composition diagnostics, not changes made by this
+suite. The fixtures intentionally remain present so later runtime/build work can
+turn each category into behavioral results without rewriting coverage.
+
+## Stopping boundary
+
+The remaining upstream TLS cases were not copied when they depend on one or more
+of the following:
+
+- renegotiation, tracing/keylog output, PSK, OCSP, FIPS, engines/providers,
+  OpenSSL/rustls-specific cipher/security-level behavior, or legacy protocol
+  availability;
+- system/extra CA environment flags, expired certificates, platform cipher
+  inventories, native certificate dumps, or absolute fixture paths;
+- internet DNS/endpoints, named pipes, fixed ports, process CLI flags, cluster or
+  worker orchestration;
+- large transfers, memory/GC pressure, concurrent stress, fault injection,
+  socket/kernel races, handshake timeouts, or session-ticket timing;
+- raw error strings, stack traces, cipher ordering, ephemeral port values, and
+  other backend- or environment-specific output.
+
+Those categories need separate targeted runtime/build work or a purpose-built
+harness. Within the portable boundary, further upstream cases are duplicates of
+the semantic contracts already represented here.

test-parity/node-suite/tls/alpn/negotiation.ts

@@ -0,0 +1,16 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+let serverProtocol: string | false | null = null;
+const server = tls.createServer({ key, cert, ALPNProtocols: ["h2", "http/1.1"] }, (socket) => {
+  serverProtocol = socket.alpnProtocol;
+  socket.end();
+});
+server.listen(0, "127.0.0.1", () => {
+  const client = tls.connect({ host: "127.0.0.1", port: (server.address() as any).port, rejectUnauthorized: false, ALPNProtocols: ["http/1.1", "h2"] });
+  client.on("secureConnect", () => console.log("client:", client.alpnProtocol));
+  client.on("close", () => server.close(() => console.log("server:", serverProtocol)));
+});

test-parity/node-suite/tls/context/cipher-validation.ts

@@ -0,0 +1,15 @@
+import tls from "node:tls";
+
+function probe(label: string, options: any) {
+  try {
+    tls.createSecureContext(options);
+    console.log(label + ": ok");
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError, err.code);
+  }
+}
+probe("default", {});
+probe("tls13", { ciphers: "TLS_AES_128_GCM_SHA256" });
+probe("empty", { ciphers: "" });
+probe("number", { ciphers: 1 });
+probe("unknown", { ciphers: "NOT_A_CIPHER" });

test-parity/node-suite/tls/context/material-type-validation.ts

@@ -0,0 +1,15 @@
+import tls from "node:tls";
+
+function probe(label: string, options: any) {
+  try {
+    tls.createSecureContext(options);
+    console.log(label + ": no throw");
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError, err.code);
+  }
+}
+probe("key boolean", { key: true });
+probe("cert boolean", { cert: true });
+probe("ca object", { ca: {} });
+probe("passphrase number", { key: "bad", passphrase: 1 });
+probe("pfx object", { pfx: {} });

test-parity/node-suite/tls/context/secure-context-empty-options.ts

@@ -0,0 +1,10 @@
+import tls from "node:tls";
+
+for (const value of [undefined, null, false, 0, ""] as any[]) {
+  try {
+    const context = tls.createSecureContext(value);
+    console.log(typeof value + ":", context instanceof tls.SecureContext, Object.keys(context).join(","));
+  } catch (err: any) {
+    console.log(typeof value + ":", err.name, err.code);
+  }
+}

test-parity/node-suite/tls/context/secure-context-fixed-certificate.ts

@@ -0,0 +1,14 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+for (const material of [
+  { key, cert },
+  { key: key.toString(), cert: cert.toString() },
+  { key, cert, ca: cert },
+]) {
+  const context = tls.createSecureContext(material);
+  console.log("context:", context instanceof tls.SecureContext, typeof context.context);
+}

test-parity/node-suite/tls/context/version-validation.ts

@@ -0,0 +1,16 @@
+import tls from "node:tls";
+
+function probe(label: string, options: any) {
+  try {
+    const context = tls.createSecureContext(options);
+    console.log(label + ":", context instanceof tls.SecureContext);
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError, err.code);
+  }
+}
+probe("range", { minVersion: "TLSv1.2", maxVersion: "TLSv1.3" });
+probe("invalid minimum", { minVersion: "TLSv9" });
+probe("invalid maximum", { maxVersion: "TLSv9" });
+probe("minimum conflict", { secureProtocol: "TLSv1_2_method", minVersion: "TLSv1.2" });
+probe("maximum conflict", { secureProtocol: "TLSv1_2_method", maxVersion: "TLSv1.2" });
+probe("invalid method", { secureProtocol: "not-a-method" });

test-parity/node-suite/tls/fixtures/localhost-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAg2gAwIBAgIUZF3wbyk6BduDu+lEeegKd2ULMK8wDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDUyNDE3NDI1NloXDTM2MDUy
+MTE3NDI1NlowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAjekpyhiK0q4H8TQo01JTA564FZpOitgwvIYMe3qhf0dF
+lo2CbjxJcx5GOQ57k6vcNlLfIL2yV8f7hJNuFlfLAFvtm9pm45BvbsPvduW1AuSI
+3oA/fpfsQ5K1VgAPbLZFhdndCjoGW3/ZO8PbUC5DTge5luCfXoV0zFzZATbJxziy
+QZ9nYspc58Se6Xj0KhM3XCy2S7V5wVPRXo2nIW5ho83yHfKyVyKEew7nloxhrNAY
+iRwHzVzBvCotdgZK/lBm1qsugHs31LR6T75izQGooIN1wz2V9kiHCW+s3CmgFCy2
+5AbN547xLwn4djh5Tz4lJhA4Rh0D0F/vzceL5ToJBwIDAQABo28wbTAdBgNVHQ4E
+FgQU1s+brNmcdkCqkncnW6rNlJpdiP0wHwYDVR0jBBgwFoAU1s+brNmcdkCqkncn
+W6rNlJpdiP0wDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SH
+BH8AAAEwDQYJKoZIhvcNAQELBQADggEBAHFmvSxFCTHcqiocEHF3i0seBmNwWq40
+TtyVf9qyZYUZVqM/Z7tGDsNfNOhM+YscLs1ZTs8XzdpdYBEVyCLDYGjb4Cv6r5gS
+hr+E0NQBnPuker6Rw64nzahfWYjf/Eo+7nwUbCahTbXHAs43c4m0bmL02r1NxVmv
+BKGQKO/uR9Dy+3TKykNQkacKJ6oDxdTDovMUKlbwU/HlyzwK/HTm762cJfgZiMYM
+uru8x9wmqogCQSAz2q6a6q/CZfn1o7S5KiWd0FzinP+50g5cSL/ob0GJ8Jge1oI5
+5rap/3DFfnTn0zfJ60U52+BVFnOIqkYT7/g5N4laGrza73tYXq7FV4s=
+-----END CERTIFICATE-----

test-parity/node-suite/tls/fixtures/localhost-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCN6SnKGIrSrgfx
+NCjTUlMDnrgVmk6K2DC8hgx7eqF/R0WWjYJuPElzHkY5DnuTq9w2Ut8gvbJXx/uE
+k24WV8sAW+2b2mbjkG9uw+925bUC5IjegD9+l+xDkrVWAA9stkWF2d0KOgZbf9k7
+w9tQLkNOB7mW4J9ehXTMXNkBNsnHOLJBn2diylznxJ7pePQqEzdcLLZLtXnBU9Fe
+jachbmGjzfId8rJXIoR7DueWjGGs0BiJHAfNXMG8Ki12Bkr+UGbWqy6AezfUtHpP
+vmLNAaigg3XDPZX2SIcJb6zcKaAULLbkBs3njvEvCfh2OHlPPiUmEDhGHQPQX+/N
+x4vlOgkHAgMBAAECggEACFfV8iDBQKOkqeSkJdBoOwVA01xQE8+kBeFnqHbMOdxp
+1fEZ4vs+Yjs8a6xTTZpEBxmWLqmYa5rBSckVJtEgiTPeY1RSyjw6oOt6D6Zvnuzq
+sxIdKYcrB8n/SUAVqBGLQtRNL4W7y/NXRTE9mpgtss+3dIxeMkNsW3t18qFS+Zhg
+TP8q984k+zl3QOz6sc5T39Unuk1g98LC2sjCXwKANzZRMBMigoGDnWgk9t86cEXM
+YWmyStS89HKEDmxWQMRIc/6zw5YC9Jo0cF2OJxGtN/O+LLeeNoJcdnlSAcyYRU1Q
+asJhtNkMwfMRrTVH0kQfF5X3a/aJfusiJnQBcvlVeQKBgQDF8rI8dlaQ7jNOfSoZ
+FhphZe1DriFaulRA9PUwrxEb/qvRstre0Egu967ILmqoqKfufyNT4W5JnWngliN6
+S7D9cvxpW0RsUQHZXMqZp7s6kt4hAdziuyC2Wx2y6+zFHkbOwJcaULYrSNHJCPOj
+cMu5TIplum+hnO9rMHKEpE0fAwKBgQC3h17rEy4uFbWPQD3fNjAi9QzIKX9wm8eD
+SYekgZaHpAjrLCa8oNR6qMxU5Cpn7I3o2HegSUe29jDAr8GMp47JYRTGMHUl1Zwa
+KtSGEH19sRhVUqIVW2h2/tysuaYpK1hFjPWM+KpKQFNzgt2EPf5057zE7gOHLcAL
+UccMgP1crQKBgQCy4h1SaHrYZHq3LoNRwli6thrRc9YuoH4taXD+uuaSTvZE/gWv
+H7hrwWcQ/mli229PJ1PspKc/HWMmE2giR669jCEwsMrHu/kYzjNE4oBfcYQNfhp4
+RzVLtlHDdFM226KPixnCLThDK35x14YdqHxiixnyzqW8/g6a5mBHIBeVswKBgQCT
+y79DndGdqTvqHbj1zWScci0V8F1BqSHVd1x1vSolF5NbF9YmJ3qVQOQ0JP6FbHmn
+ntNPUFQhYkdGlQNQKwuQ3s5lAFcG3ev1IrK9OABnPTu0UnRWsKMC2SGLM4I9Ozu9
+3tNL8GDqpLzPk/6h5W7KZGifSnGq5cv3EaczSZk/jQKBgAcaLGi25ozeFgK1qvuQ
+WFTjLYV6KaMrGd5+NF+2a/NQsDGTZSF1egKUvE5QH5YNf37xWkqwvR3rsbenxLAG
+aNYjvX+bUs4Mc/bgNkO51P9sH6YoKsuFzTTx4eR5ZS+dtfoiZMfzKkRBK4Baggrv
+7S9Q3thVBhvBcz19oFN2Rmvf
+-----END PRIVATE KEY-----

test-parity/node-suite/tls/handshake/authorized-loopback.ts

@@ -0,0 +1,18 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+const server = tls.createServer({ key, cert }, (socket) => socket.end("ok"));
+server.listen(0, "127.0.0.1", () => {
+  const client = tls.connect({ host: "127.0.0.1", port: (server.address() as any).port, servername: "localhost", ca: cert });
+  client.once("secureConnect", () => {
+    const peer: any = client.getPeerCertificate();
+    console.log("authorization:", client.authorized, client.authorizationError);
+    console.log("peer identity:", peer.subject?.CN, peer.subjectaltname?.includes("DNS:localhost"), peer.subjectaltname?.includes("IP Address:127.0.0.1"));
+  });
+  client.on("error", (err: any) => console.log("client error:", err.code));
+  client.on("close", () => server.close());
+  client.resume();
+});

test-parity/node-suite/tls/handshake/basic-loopback.ts

@@ -0,0 +1,30 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+const events: string[] = [];
+const server = tls.createServer({ key, cert }, (socket) => {
+  events.push("server:secureConnection");
+  socket.on("data", (chunk) => {
+    events.push("server:data:" + chunk.toString());
+    socket.end("pong");
+  });
+});
+server.on("error", (err: any) => events.push("server:error:" + err.code));
+server.listen(0, "127.0.0.1", () => {
+  events.push("server:listening");
+  const address: any = server.address();
+  const client = tls.connect({ host: "127.0.0.1", port: address.port, rejectUnauthorized: false });
+  client.on("secureConnect", () => {
+    events.push("client:secureConnect");
+    client.write("ping");
+  });
+  client.on("data", (chunk) => events.push("client:data:" + chunk.toString()));
+  client.on("error", (err: any) => events.push("client:error:" + err.code));
+  client.on("close", () => server.close(() => {
+    events.push("server:close");
+    console.log(events.join("|"));
+  }));
+});

test-parity/node-suite/tls/handshake/close-ordering.ts

@@ -0,0 +1,32 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+const events: string[] = [];
+let clientClosed = false;
+let serverSocketClosed = false;
+let serverClosed = false;
+function report() {
+  if (clientClosed && serverSocketClosed && serverClosed) console.log(events.join("|"));
+}
+const server = tls.createServer({ key, cert }, (socket) => {
+  socket.on("end", () => events.push("server:end"));
+  socket.on("close", () => { events.push("server:socket-close"); serverSocketClosed = true; report(); });
+  socket.end();
+});
+server.listen(0, "127.0.0.1", () => {
+  const client = tls.connect({ host: "127.0.0.1", port: (server.address() as any).port, rejectUnauthorized: false });
+  client.on("secureConnect", () => events.push("client:secureConnect"));
+  client.on("end", () => events.push("client:end"));
+  client.on("close", () => {
+    events.push("client:close");
+    clientClosed = true;
+    server.close(() => {
+      events.push("server:close");
+      serverClosed = true;
+      report();
+    });
+  });
+});

test-parity/node-suite/tls/handshake/reject-untrusted.ts

@@ -0,0 +1,16 @@
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const fixture = new URL("../fixtures/", import.meta.url);
+const key = readFileSync(new URL("localhost-key.pem", fixture));
+const cert = readFileSync(new URL("localhost-cert.pem", fixture));
+let secure = false;
+let errorCode = "none";
+const server = tls.createServer({ key, cert });
+server.on("tlsClientError", () => {});
+server.listen(0, "127.0.0.1", () => {
+  const client = tls.connect({ host: "127.0.0.1", port: (server.address() as any).port, servername: "localhost" });
+  client.on("secureConnect", () => { secure = true; });
+  client.on("error", (err: any) => { errorCode = err.code; });
+  client.on("close", () => server.close(() => console.log("rejected:", !secure, errorCode)));
+});

test-parity/node-suite/tls/identity/dns-patterns.ts

@@ -0,0 +1,12 @@
+import tls from "node:tls";
+
+function ok(host: string, cert: any) {
+  return tls.checkServerIdentity(host, cert) === undefined;
+}
+console.log("case insensitive:", ok("a.example", { subject: { CN: "A.EXAMPLE" } }));
+console.log("trailing dot:", ok("a.example", { subject: { CN: "a.example." } }));
+console.log("single wildcard:", ok("api.example.com", { subject: { CN: "*.example.com" } }));
+console.log("wildcard depth:", ok("deep.api.example.com", { subject: { CN: "*.example.com" } }));
+console.log("partial wildcard:", ok("api.example", { subject: { CN: "a*i.example" } }));
+console.log("multiple cn:", ok("second.example", { subject: { CN: ["first.example", "second.example"] } }));
+console.log("san overrides cn:", ok("cn.example", { subjectaltname: "DNS:san.example", subject: { CN: "cn.example" } }));

test-parity/node-suite/tls/identity/error-shape.ts

@@ -0,0 +1,9 @@
+import tls from "node:tls";
+
+const cert = { subjectaltname: "DNS:good.example", subject: { CN: "fallback.example" } };
+const err: any = tls.checkServerIdentity("bad.example", cert);
+console.log("class:", err instanceof Error, err.name);
+console.log("code:", err.code);
+console.log("fields:", err.host, err.cert === cert, typeof err.reason);
+console.log("enumerable:", Object.keys(err).sort().join(","));
+console.log("message semantic:", err.message.includes("bad.example"), err.message.includes("good.example"));

test-parity/node-suite/tls/identity/fixed-certificate.ts

@@ -0,0 +1,11 @@
+import tls from "node:tls";
+import { X509Certificate } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+const pem = readFileSync(new URL("../fixtures/localhost-cert.pem", import.meta.url));
+const cert = new X509Certificate(pem);
+const legacy = cert.toLegacyObject();
+console.log("localhost:", tls.checkServerIdentity("localhost", legacy) === undefined);
+console.log("ipv4:", tls.checkServerIdentity("127.0.0.1", legacy) === undefined);
+const mismatch: any = tls.checkServerIdentity("other.local", legacy);
+console.log("mismatch:", mismatch instanceof Error, mismatch.code, mismatch.host, mismatch.cert === legacy);

test-parity/node-suite/tls/identity/ip-addresses.ts

@@ -0,0 +1,11 @@
+import tls from "node:tls";
+
+function result(host: string, san?: string, cn?: string) {
+  const err = tls.checkServerIdentity(host, { subjectaltname: san, subject: cn ? { CN: cn } : {} });
+  return err ? [err.code, err.host, typeof err.reason].join("/") : "ok";
+}
+console.log("ipv4 san:", result("127.0.0.1", "IP Address:127.0.0.1"));
+console.log("ipv4 dns rejected:", result("127.0.0.1", "DNS:127.0.0.1", "127.0.0.1"));
+console.log("ipv4 cn rejected:", result("127.0.0.1", undefined, "127.0.0.1"));
+console.log("ipv4 mismatch:", result("127.0.0.2", "IP Address:127.0.0.1"));
+console.log("ipv6 canonical:", result("::1", "IP Address:0:0:0:0:0:0:0:1"));

test-parity/node-suite/tls/options/alpn-validation.ts

@@ -0,0 +1,17 @@
+import tls from "node:tls";
+
+function probe(label: string, protocols: any) {
+  try {
+    const socket = tls.connect({ port: 1, ALPNProtocols: protocols });
+    socket.on("error", () => {});
+    socket.destroy();
+    console.log(label + ": ok");
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError || err instanceof RangeError, err.code);
+  }
+}
+probe("array", ["h2", "http/1.1"]);
+probe("buffer", Buffer.from([2, 104, 50]));
+probe("long name", ["a".repeat(256)]);
+probe("non string", [1]);
+probe("boolean", true);

test-parity/node-suite/tls/options/connect-validation.ts

@@ -0,0 +1,17 @@
+import tls from "node:tls";
+
+function probe(label: string, options: any) {
+  try {
+    const socket = tls.connect(options);
+    socket.destroy();
+    console.log(label + ": no throw");
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError || err instanceof RangeError, err.code);
+  }
+}
+probe("missing port", {});
+probe("port type", { port: "bad" });
+probe("port range", { port: 70000 });
+probe("identity null", { port: 1, checkServerIdentity: null });
+probe("identity number", { port: 1, checkServerIdentity: 1 });
+probe("alpn type", { port: 1, ALPNProtocols: true });

test-parity/node-suite/tls/options/create-server-validation.ts

@@ -0,0 +1,17 @@
+import tls from "node:tls";
+
+function probe(label: string, options: any) {
+  try {
+    const server = tls.createServer(options);
+    console.log(label + ":", server instanceof tls.Server);
+  } catch (err: any) {
+    console.log(label + ":", err instanceof TypeError, err.code);
+  }
+}
+probe("empty", {});
+probe("ciphers", { ciphers: 1 });
+probe("curve", { ecdhCurve: 1 });
+probe("handshake timeout", { handshakeTimeout: "1" });
+probe("session timeout", { sessionTimeout: "1" });
+probe("ticket keys type", { ticketKeys: "bad" });
+probe("ticket keys length", { ticketKeys: Buffer.alloc(0) });