From c697c14c77016e9d8f0b0ebf10b50b72315edea9 Mon Sep 17 00:00:00 2001
From: JonasBa <jonas@badalic.com>
Date: Fri, 7 Mar 2025 10:29:21 -0500
Subject: [PATCH] tls: remove deprecated tls.createSecurePair

---
 benchmark/tls/secure-pair.js                  |  16 +-
 doc/api/deprecations.md                       |   5 +-
 doc/api/tls.md                                |  12 --
 lib/internal/tls/secure-pair.js               |  87 --------
 lib/tls.js                                    |   6 -
 test/parallel/test-tls-basic-validations.js   |   9 -
 test/parallel/test-tls-external-accessor.js   |   6 -
 test/parallel/test-tls-handshake-nohang.js    |  32 ---
 test/parallel/test-tls-legacy-deprecated.js   |  15 --
 test/parallel/test-tls-securepair-fiftharg.js |  25 ---
 test/parallel/test-tls-securepair-leak.js     |  28 ---
 test/parallel/test-tls-securepair-server.js   | 149 --------------
 ...t-tls-socket-snicallback-without-server.js |   3 -
 test/root.status                              |   1 -
 test/sequential/test-tls-securepair-client.js | 191 ------------------
 15 files changed, 5 insertions(+), 580 deletions(-)
 delete mode 100644 lib/internal/tls/secure-pair.js
 delete mode 100644 test/parallel/test-tls-handshake-nohang.js
 delete mode 100644 test/parallel/test-tls-legacy-deprecated.js
 delete mode 100644 test/parallel/test-tls-securepair-fiftharg.js
 delete mode 100644 test/parallel/test-tls-securepair-leak.js
 delete mode 100644 test/parallel/test-tls-securepair-server.js
 delete mode 100644 test/sequential/test-tls-securepair-client.js

diff --git a/benchmark/tls/secure-pair.js b/benchmark/tls/secure-pair.js
index 1c5dd732d1ca9e..a253bbf0260733 100644
--- a/benchmark/tls/secure-pair.js
+++ b/benchmark/tls/secure-pair.js
@@ -2,7 +2,7 @@
 const common = require('../common.js');
 const bench = common.createBenchmark(main, {
   dur: [5],
-  securing: ['SecurePair', 'TLSSocket', 'clear'],
+  securing: ['TLSSocket', 'clear'],
   size: [100, 1024, 1024 * 1024],
 }, {
   flags: ['--no-warnings'],
@@ -68,9 +68,6 @@ function main({ dur, size, securing }) {
   function onProxyConnection(conn) {
     const client = net.connect(REDIRECT_PORT, () => {
       switch (securing) {
-        case 'SecurePair':
-          securePair(conn, client);
-          break;
         case 'TLSSocket':
           secureTLSSocket(conn, client);
           break;
@@ -83,17 +80,6 @@ function main({ dur, size, securing }) {
     });
   }
 
-  function securePair(conn, client) {
-    const serverCtx = tls.createSecureContext(options);
-    const serverPair = tls.createSecurePair(serverCtx, true, true, false);
-    conn.pipe(serverPair.encrypted);
-    serverPair.encrypted.pipe(conn);
-    serverPair.on('error', (error) => {
-      throw new Error(`Pair error: ${error}`);
-    });
-    serverPair.cleartext.pipe(client);
-  }
-
   function secureTLSSocket(conn, client) {
     const serverSocket = new tls.TLSSocket(conn, options);
     serverSocket.on('error', (e) => {
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 84dc58cfc449df..15315d55db6146 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -1488,6 +1488,9 @@ officially supported API.
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/xxxxx
+    description: End-of-Life.
   - version: v8.0.0
     pr-url: https://github.com/nodejs/node/pull/11349
     description: Runtime deprecation.
@@ -1507,7 +1510,7 @@ changes:
     description: Runtime deprecation.
 -->
 
-Type: Runtime
+Type: End-of-Life
 
 The `tls.createSecurePair()` API was deprecated in documentation in Node.js
 0.11.3. Users should use `tls.Socket` instead.
diff --git a/doc/api/tls.md b/doc/api/tls.md
index 86644cea76b6a3..4ec51a1b6dba4d 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -570,17 +570,6 @@ The `cryptoStream.bytesWritten` property returns the total number of bytes
 written to the underlying socket _including_ the bytes required for the
 implementation of the TLS protocol.
 
-## Class: `tls.SecurePair`
-
-<!-- YAML
-added: v0.3.2
-deprecated: v0.11.3
--->
-
-> Stability: 0 - Deprecated: Use [`tls.TLSSocket`][] instead.
-
-Returned by [`tls.createSecurePair()`][].
-
 ### Event: `'secure'`
 
 <!-- YAML
@@ -2556,7 +2545,6 @@ added:
 [`tls.TLSSocket`]: #class-tlstlssocket
 [`tls.connect()`]: #tlsconnectoptions-callback
 [`tls.createSecureContext()`]: #tlscreatesecurecontextoptions
-[`tls.createSecurePair()`]: #tlscreatesecurepaircontext-isserver-requestcert-rejectunauthorized-options
 [`tls.createServer()`]: #tlscreateserveroptions-secureconnectionlistener
 [`tls.getCACertificates()`]: #tlsgetcacertificatestype
 [`tls.getCiphers()`]: #tlsgetciphers
diff --git a/lib/internal/tls/secure-pair.js b/lib/internal/tls/secure-pair.js
deleted file mode 100644
index a7e02eee02723e..00000000000000
--- a/lib/internal/tls/secure-pair.js
+++ /dev/null
@@ -1,87 +0,0 @@
-'use strict';
-
-const {
-  ReflectConstruct,
-  Symbol,
-} = primordials;
-
-const EventEmitter = require('events');
-const { kEmptyObject } = require('internal/util');
-const { Duplex } = require('stream');
-const _tls_wrap = require('_tls_wrap');
-const _tls_common = require('_tls_common');
-
-const kCallback = Symbol('Callback');
-const kOtherSide = Symbol('Other');
-
-class DuplexSocket extends Duplex {
-  constructor() {
-    super();
-    this[kCallback] = null;
-    this[kOtherSide] = null;
-  }
-
-  _read() {
-    const callback = this[kCallback];
-    if (callback) {
-      this[kCallback] = null;
-      callback();
-    }
-  }
-
-  _write(chunk, encoding, callback) {
-    if (chunk.length === 0) {
-      process.nextTick(callback);
-    } else {
-      this[kOtherSide].push(chunk);
-      this[kOtherSide][kCallback] = callback;
-    }
-  }
-
-  _final(callback) {
-    this[kOtherSide].on('end', callback);
-    this[kOtherSide].push(null);
-  }
-}
-
-class DuplexPair {
-  constructor() {
-    this.socket1 = new DuplexSocket();
-    this.socket2 = new DuplexSocket();
-    this.socket1[kOtherSide] = this.socket2;
-    this.socket2[kOtherSide] = this.socket1;
-  }
-}
-
-class SecurePair extends EventEmitter {
-  constructor(secureContext = _tls_common.createSecureContext(),
-              isServer = false,
-              requestCert = !isServer,
-              rejectUnauthorized = false,
-              options = kEmptyObject) {
-    super();
-    const { socket1, socket2 } = new DuplexPair();
-
-    this.server = options.server;
-    this.credentials = secureContext;
-
-    this.encrypted = socket1;
-    this.cleartext = new _tls_wrap.TLSSocket(socket2, {
-      secureContext,
-      isServer,
-      requestCert,
-      rejectUnauthorized,
-      ...options,
-    });
-    this.cleartext.once('secure', () => this.emit('secure'));
-  }
-
-  destroy() {
-    this.cleartext.destroy();
-    this.encrypted.destroy();
-  }
-}
-
-exports.createSecurePair = function createSecurePair(...args) {
-  return ReflectConstruct(SecurePair, args);
-};
diff --git a/lib/tls.js b/lib/tls.js
index b4657c08ec94bf..06a6695034d8a0 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -57,7 +57,6 @@ const { Buffer } = require('buffer');
 const { canonicalizeIP } = internalBinding('cares_wrap');
 const _tls_common = require('_tls_common');
 const _tls_wrap = require('_tls_wrap');
-const { createSecurePair } = require('internal/tls/secure-pair');
 const { validateString } = require('internal/validators');
 
 // Allow {CLIENT_RENEG_LIMIT} client-initiated session renegotiations
@@ -393,8 +392,3 @@ exports.TLSSocket = _tls_wrap.TLSSocket;
 exports.Server = _tls_wrap.Server;
 exports.createServer = _tls_wrap.createServer;
 exports.connect = _tls_wrap.connect;
-
-exports.createSecurePair = internalUtil.deprecate(
-  createSecurePair,
-  'tls.createSecurePair() is deprecated. Please use ' +
-  'tls.TLSSocket instead.', 'DEP0064');
diff --git a/test/parallel/test-tls-basic-validations.js b/test/parallel/test-tls-basic-validations.js
index 64ae23758f2353..0446b6aef219fd 100644
--- a/test/parallel/test-tls-basic-validations.js
+++ b/test/parallel/test-tls-basic-validations.js
@@ -80,15 +80,6 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
   message: /The property 'options\.ticketKeys' must be exactly 48 bytes/
 });
 
-assert.throws(
-  () => tls.createSecurePair({}),
-  {
-    message: 'context must be a SecureContext',
-    code: 'ERR_TLS_INVALID_CONTEXT',
-    name: 'TypeError',
-  }
-);
-
 {
   const buffer = Buffer.from('abcd');
   const out = {};
diff --git a/test/parallel/test-tls-external-accessor.js b/test/parallel/test-tls-external-accessor.js
index ea138d8dc4e968..bdc4184b56b52b 100644
--- a/test/parallel/test-tls-external-accessor.js
+++ b/test/parallel/test-tls-external-accessor.js
@@ -14,9 +14,3 @@ const tls = require('tls');
   assert.throws(() => cctx._external, TypeError);
   pctx._external; // eslint-disable-line no-unused-expressions
 }
-{
-  const pctx = tls.createSecurePair().credentials.context;
-  const cctx = { __proto__: pctx };
-  assert.throws(() => cctx._external, TypeError);
-  pctx._external; // eslint-disable-line no-unused-expressions
-}
diff --git a/test/parallel/test-tls-handshake-nohang.js b/test/parallel/test-tls-handshake-nohang.js
deleted file mode 100644
index e724fcd3422b00..00000000000000
--- a/test/parallel/test-tls-handshake-nohang.js
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-const common = require('../common');
-
-if (!common.hasCrypto)
-  common.skip('missing crypto');
-
-const tls = require('tls');
-
-// neither should hang
-tls.createSecurePair(null, false, false, false);
-tls.createSecurePair(null, true, false, false);
diff --git a/test/parallel/test-tls-legacy-deprecated.js b/test/parallel/test-tls-legacy-deprecated.js
deleted file mode 100644
index 8aa8fd31d2e255..00000000000000
--- a/test/parallel/test-tls-legacy-deprecated.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Flags: --no-warnings
-'use strict';
-const common = require('../common');
-if (!common.hasCrypto)
-  common.skip('missing crypto');
-
-const tls = require('tls');
-
-common.expectWarning(
-  'DeprecationWarning',
-  'tls.createSecurePair() is deprecated. Please use tls.TLSSocket instead.',
-  'DEP0064'
-);
-
-tls.createSecurePair();
diff --git a/test/parallel/test-tls-securepair-fiftharg.js b/test/parallel/test-tls-securepair-fiftharg.js
deleted file mode 100644
index 9adb2bf424818b..00000000000000
--- a/test/parallel/test-tls-securepair-fiftharg.js
+++ /dev/null
@@ -1,25 +0,0 @@
-'use strict';
-
-const common = require('../common');
-if (!common.hasCrypto)
-  common.skip('missing crypto');
-
-const assert = require('assert');
-const tls = require('tls');
-const fixtures = require('../common/fixtures');
-
-const sslcontext = tls.createSecureContext({
-  cert: fixtures.readKey('rsa_cert.crt'),
-  key: fixtures.readKey('rsa_private.pem')
-});
-
-const pair = tls.createSecurePair(sslcontext, true, false, false, {
-  SNICallback: common.mustCall((servername, cb) => {
-    assert.strictEqual(servername, 'www.google.com');
-  })
-});
-
-// Captured traffic from browser's request to https://www.google.com
-const sslHello = fixtures.readSync('google_ssl_hello.bin');
-
-pair.encrypted.write(sslHello);
diff --git a/test/parallel/test-tls-securepair-leak.js b/test/parallel/test-tls-securepair-leak.js
deleted file mode 100644
index e3d5c2cdf37b5d..00000000000000
--- a/test/parallel/test-tls-securepair-leak.js
+++ /dev/null
@@ -1,28 +0,0 @@
-// Flags: --expose-gc --no-deprecation
-'use strict';
-
-const common = require('../common');
-if (!common.hasCrypto)
-  common.skip('missing crypto');
-
-const assert = require('assert');
-const { createSecureContext } = require('tls');
-const { createSecurePair } = require('tls');
-
-const before = process.memoryUsage().external;
-{
-  const context = createSecureContext();
-  const options = {};
-  for (let i = 0; i < 1e4; i += 1)
-    createSecurePair(context, false, false, false, options).destroy();
-}
-setImmediate(() => {
-  globalThis.gc();
-  const after = process.memoryUsage().external;
-
-  // It's not an exact science but a SecurePair grows .external by about 45 KiB.
-  // Unless AdjustAmountOfExternalAllocatedMemory() is called on destruction,
-  // 10,000 instances make it grow by well over 400 MiB.  Allow for some slop
-  // because objects like buffers also affect the external limit.
-  assert(after - before < 25 << 20);
-});
diff --git a/test/parallel/test-tls-securepair-server.js b/test/parallel/test-tls-securepair-server.js
deleted file mode 100644
index fb4ebe6a2511cf..00000000000000
--- a/test/parallel/test-tls-securepair-server.js
+++ /dev/null
@@ -1,149 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-const common = require('../common');
-if (!common.hasCrypto) {
-  common.skip('missing crypto');
-}
-
-const { opensslCli } = require('../common/crypto');
-
-if (!opensslCli) {
-  common.skip('missing openssl-cli');
-}
-
-const assert = require('assert');
-const tls = require('tls');
-const net = require('net');
-const spawn = require('child_process').spawn;
-const fixtures = require('../common/fixtures');
-
-const key = fixtures.readKey('rsa_private.pem');
-const cert = fixtures.readKey('rsa_cert.crt');
-
-function log(a) {
-  console.error('***server***', a);
-}
-
-const server = net.createServer(common.mustCall(function(socket) {
-  log(`connection fd=${socket.fd}`);
-  const sslcontext = tls.createSecureContext({ key, cert });
-  sslcontext.context.setCiphers('RC4-SHA:AES128-SHA:AES256-SHA');
-
-  const pair = tls.createSecurePair(sslcontext, true);
-
-  assert.ok(pair.encrypted.writable);
-  assert.ok(pair.cleartext.writable);
-
-  pair.encrypted.pipe(socket);
-  socket.pipe(pair.encrypted);
-
-  log('i set it secure');
-
-  pair.on('secure', function() {
-    log('connected+secure!');
-    pair.cleartext.write('hello\r\n');
-    log(pair.cleartext.getPeerCertificate());
-    log(pair.cleartext.getCipher());
-  });
-
-  pair.cleartext.on('data', function(data) {
-    log(`read bytes ${data.length}`);
-    pair.cleartext.write(data);
-  });
-
-  socket.on('end', function() {
-    log('socket end');
-  });
-
-  pair.cleartext.on('error', function(err) {
-    log('got error: ');
-    log(err);
-    socket.destroy();
-  });
-
-  pair.encrypted.on('error', function(err) {
-    log('encrypted error: ');
-    log(err);
-    socket.destroy();
-  });
-
-  socket.on('error', function(err) {
-    log('socket error: ');
-    log(err);
-    socket.destroy();
-  });
-
-  socket.on('close', function(err) {
-    log('socket closed');
-  });
-
-  pair.on('error', function(err) {
-    log('secure error: ');
-    log(err);
-    socket.destroy();
-  });
-}));
-
-let gotHello = false;
-let sentWorld = false;
-let gotWorld = false;
-
-server.listen(0, common.mustCall(function() {
-  // To test use: openssl s_client -connect localhost:8000
-
-  const args = ['s_client', '-connect', `127.0.0.1:${this.address().port}`];
-
-  const client = spawn(opensslCli, args);
-
-
-  let out = '';
-
-  client.stdout.setEncoding('utf8');
-  client.stdout.on('data', function(d) {
-    out += d;
-
-    if (!gotHello && /hello/.test(out)) {
-      gotHello = true;
-      client.stdin.write('world\r\n');
-      sentWorld = true;
-    }
-
-    if (!gotWorld && /world/.test(out)) {
-      gotWorld = true;
-      client.stdin.end();
-    }
-  });
-
-  client.stdout.pipe(process.stdout, { end: false });
-
-  client.on('exit', common.mustCall(function(code) {
-    assert.strictEqual(code, 0);
-    server.close();
-  }));
-}));
-
-process.on('exit', function() {
-  assert.ok(gotHello);
-  assert.ok(sentWorld);
-  assert.ok(gotWorld);
-});
diff --git a/test/parallel/test-tls-socket-snicallback-without-server.js b/test/parallel/test-tls-socket-snicallback-without-server.js
index 9ad5d554c81c39..e278b4975ad59c 100644
--- a/test/parallel/test-tls-socket-snicallback-without-server.js
+++ b/test/parallel/test-tls-socket-snicallback-without-server.js
@@ -1,8 +1,5 @@
 'use strict';
 
-// This is based on test-tls-securepair-fiftharg.js
-// for the deprecated `tls.createSecurePair()` variant.
-
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
diff --git a/test/root.status b/test/root.status
index 22f7260246f5e0..4ae018b47cc488 100644
--- a/test/root.status
+++ b/test/root.status
@@ -78,7 +78,6 @@ parallel/test-tick-processor-arguments: SLOW
 parallel/test-tls-env-bad-extra-ca: SLOW
 parallel/test-tls-env-extra-ca: SLOW
 parallel/test-tls-handshake-exception: SLOW
-parallel/test-tls-securepair-leak: SLOW
 parallel/test-tls-server-verify: SLOW
 parallel/test-tls-session-cache: SLOW
 parallel/test-tls-ticket-cluster: SLOW
diff --git a/test/sequential/test-tls-securepair-client.js b/test/sequential/test-tls-securepair-client.js
deleted file mode 100644
index 262518621b5f3f..00000000000000
--- a/test/sequential/test-tls-securepair-client.js
+++ /dev/null
@@ -1,191 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-const common = require('../common');
-
-if (!common.hasCrypto) {
-  common.skip('missing crypto');
-}
-
-const { opensslCli } = require('../common/crypto');
-
-if (!opensslCli) {
-  common.skip('node compiled without OpenSSL CLI.');
-}
-
-if (common.isWindows) {
-  common.skip('test does not work on Windows'); // ...but it should!
-}
-
-const net = require('net');
-const assert = require('assert');
-const fixtures = require('../common/fixtures');
-const tls = require('tls');
-const spawn = require('child_process').spawn;
-
-const useIPv4 = !common.hasIPv6;
-
-test1();
-
-// simple/test-tls-securepair-client
-function test1() {
-  test('keys/rsa_private.pem', 'keys/rsa_cert.crt', null, test2);
-}
-
-// simple/test-tls-ext-key-usage
-function test2() {
-  function check(pair) {
-    // "TLS Web Client Authentication"
-    assert.strictEqual(pair.cleartext.getPeerCertificate().ext_key_usage.length,
-                       1);
-    assert.strictEqual(pair.cleartext.getPeerCertificate().ext_key_usage[0],
-                       '1.3.6.1.5.5.7.3.2');
-  }
-  test('keys/agent4-key.pem', 'keys/agent4-cert.pem', check);
-}
-
-function test(keyPath, certPath, check, next) {
-  const key = fixtures.readSync(keyPath).toString();
-  const cert = fixtures.readSync(certPath).toString();
-
-  const server = spawn(opensslCli, ['s_server',
-                                    '-accept', 0,
-                                    '-cert', fixtures.path(certPath),
-                                    '-key', fixtures.path(keyPath),
-                                    ...(useIPv4 ? ['-4'] : []),
-  ]);
-  server.stdout.pipe(process.stdout);
-  server.stderr.pipe(process.stdout);
-
-
-  let state = 'WAIT-ACCEPT';
-
-  let serverStdoutBuffer = '';
-  server.stdout.setEncoding('utf8');
-  server.stdout.on('data', function(s) {
-    serverStdoutBuffer += s;
-    console.log(state);
-    switch (state) {
-      case 'WAIT-ACCEPT': {
-        const matches = serverStdoutBuffer.match(/ACCEPT .*?:(\d+)/);
-        if (matches) {
-          const port = matches[1];
-          state = 'WAIT-HELLO';
-          startClient(port);
-        }
-        break;
-      }
-      case 'WAIT-HELLO':
-        if (/hello/.test(serverStdoutBuffer)) {
-
-          // End the current SSL connection and exit.
-          // See s_server(1ssl).
-          server.stdin.write('Q');
-
-          state = 'WAIT-SERVER-CLOSE';
-        }
-        break;
-
-      default:
-        break;
-    }
-  });
-
-
-  const timeout = setTimeout(function() {
-    server.kill();
-    process.exit(1);
-  }, 5000);
-
-  let gotWriteCallback = false;
-  let serverExitCode = -1;
-
-  server.on('exit', function(code) {
-    serverExitCode = code;
-    clearTimeout(timeout);
-    if (next) next();
-  });
-
-
-  function startClient(port) {
-    const s = new net.Stream();
-
-    const sslcontext = tls.createSecureContext({ key, cert });
-    sslcontext.context.setCiphers('RC4-SHA:AES128-SHA:AES256-SHA');
-
-    const pair = tls.createSecurePair(sslcontext, false);
-
-    assert.ok(pair.encrypted.writable);
-    assert.ok(pair.cleartext.writable);
-
-    pair.encrypted.pipe(s);
-    s.pipe(pair.encrypted);
-
-    s.connect(port);
-
-    s.on('connect', function() {
-      console.log('client connected');
-      setTimeout(function() {
-        pair.cleartext.write('hello\r\n', function() {
-          gotWriteCallback = true;
-        });
-      }, 500);
-    });
-
-    pair.on('secure', function() {
-      console.log('client: connected+secure!');
-      console.log('client pair.cleartext.getPeerCertificate(): %j',
-                  pair.cleartext.getPeerCertificate());
-      console.log('client pair.cleartext.getCipher(): %j',
-                  pair.cleartext.getCipher());
-      if (check) check(pair);
-    });
-
-    pair.cleartext.on('data', function(d) {
-      console.log('cleartext: %s', d.toString());
-    });
-
-    s.on('close', function() {
-      console.log('client close');
-    });
-
-    pair.encrypted.on('error', function(err) {
-      console.log(`encrypted error: ${err}`);
-    });
-
-    s.on('error', function(err) {
-      console.log(`socket error: ${err}`);
-    });
-
-    pair.on('error', function(err) {
-      console.log(`secure error: ${err}`);
-    });
-  }
-
-
-  process.on('exit', function() {
-    assert.strictEqual(serverExitCode, 0);
-    assert.strictEqual(state, 'WAIT-SERVER-CLOSE');
-    assert.ok(gotWriteCallback);
-  });
-}