From b61e682fc02c6b3bec27d8ade24d3affb04f1436 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 26 Aug 2026 23:57:30 +0200
Subject: [PATCH] Revert "crypto,https,tls: runtime-deprecate OpenSSL
 engine-based APIs (DEP0183)"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit da516920fc3b091e54af21a86677574270803b81.

PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/crypto.md                             |  8 +------
 doc/api/deprecations.md                       |  5 +----
 doc/api/https.md                              |  3 ---
 doc/api/tls.md                                |  7 ------
 lib/internal/crypto/util.js                   |  9 --------
 lib/internal/tls/secure-context.js            |  3 ---
 .../addons/openssl-client-cert-engine/test.js |  6 -----
 test/addons/openssl-key-engine/test.js        |  6 -----
 test/parallel/test-crypto-dep0183.js          | 22 -------------------
 .../test-tls-clientcertengine-unsupported.js  |  9 --------
 test/parallel/test-tls-error-stack.js         | 13 +++--------
 .../test-tls-keyengine-unsupported.js         |  9 --------
 12 files changed, 5 insertions(+), 95 deletions(-)
 delete mode 100644 test/parallel/test-crypto-dep0183.js

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 6e0250f2e86..63b85c8ca70 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -6606,9 +6606,6 @@ added: v15.6.0
 <!-- YAML
 added: v0.11.11
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/63966
-    description: Runtime deprecation.
   - version:
     - v22.4.0
     - v20.16.0
@@ -6616,14 +6613,11 @@ changes:
     description: Custom engine support in OpenSSL 3 is deprecated.
 -->
 
-> Stability: 0 - Deprecated
-
 * `engine` {string}
 * `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
 
 Load and set the `engine` for some or all OpenSSL functions (selected by flags).
-Use of this API is deprecated because custom engine support has been deprecated
-since OpenSSL 3.
+Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
 
 `engine` could be either an id or a path to the engine's shared library.
 
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 9642da384ac..6c9fcecf319 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4111,9 +4111,6 @@ that are shorter than the default authentication tag length (i.e., shorter than
 
 <!-- YAML
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/63966
-    description: Runtime deprecation.
   - version:
     - v22.4.0
     - v20.16.0
@@ -4121,7 +4118,7 @@ changes:
     description: Documentation-only deprecation.
 -->
 
-Type: Runtime
+Type: Documentation-only
 
 OpenSSL 3 has deprecated support for custom engines with a recommendation to
 switch to its new provider model. The `clientCertEngine` option for
diff --git a/doc/api/https.md b/doc/api/https.md
index eba303b6600..74b759556c4 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -427,9 +427,6 @@ a `timeout` of 5 seconds.
 <!-- YAML
 added: v0.3.6
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/63966
-    description: The `clientCertEngine` option is runtime deprecated.
   - version:
     - v22.4.0
     - v20.16.0
diff --git a/doc/api/tls.md b/doc/api/tls.md
index 7e010f4c34e..d518289d493 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1988,10 +1988,6 @@ argument.
 <!-- YAML
 added: v0.11.13
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/63966
-    description: The `clientCertEngine`, `privateKeyEngine` and
-                 `privateKeyIdentifier` options are runtime deprecated.
   - version:
      - v26.4.0
      - v24.19.0
@@ -2216,9 +2212,6 @@ permissible, use 2048 bits or larger for stronger security.
 <!-- YAML
 added: v0.3.2
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/63966
-    description: The `clientCertEngine` option is runtime deprecated.
   - version:
     - v22.4.0
     - v20.16.0
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 1a49c6f4083..f915b103db4 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -96,7 +96,6 @@ const { Buffer } = require('buffer');
 const {
   emitExperimentalWarning,
   filterDuplicateStrings,
-  getDeprecationWarningEmitter,
   lazyDOMException,
   setOwnProperty,
 } = require('internal/util');
@@ -213,11 +212,6 @@ const getMacs = cachedArrayByFipsGeneration(
 const getCurves = cachedArrayByFipsGeneration(
   () => filterDuplicateStrings(_getCurves()));
 
-const emitOpenSSLEngineDeprecation = getDeprecationWarningEmitter(
-  'DEP0183',
-  'OpenSSL engine-based APIs are deprecated.',
-);
-
 function setEngine(id, flags) {
   validateString(id, 'id');
   if (flags)
@@ -228,8 +222,6 @@ function setEngine(id, flags) {
   if (flags === 0)
     flags = ENGINE_METHOD_ALL;
 
-  emitOpenSSLEngineDeprecation();
-
   if (typeof _setEngine !== 'function')
     throw new ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED();
   if (!_setEngine(id, flags))
@@ -1286,7 +1278,6 @@ module.exports = {
   getHashes,
   getMacs,
   getOptionalByteLength,
-  emitOpenSSLEngineDeprecation,
   kHandle,
   setEngine,
   toBuf,
diff --git a/lib/internal/tls/secure-context.js b/lib/internal/tls/secure-context.js
index 597d4fce927..862d7501a1d 100644
--- a/lib/internal/tls/secure-context.js
+++ b/lib/internal/tls/secure-context.js
@@ -34,7 +34,6 @@ const {
 } = require('internal/validators');
 
 const {
-  emitOpenSSLEngineDeprecation,
   toBuf,
 } = require('internal/crypto/util');
 
@@ -270,7 +269,6 @@ function configSecureContext(context, options = kEmptyObject, name = 'options')
 
     if (typeof privateKeyIdentifier === 'string' &&
         typeof privateKeyEngine === 'string') {
-      emitOpenSSLEngineDeprecation();
       if (context.setEngineKey)
         context.setEngineKey(privateKeyIdentifier, privateKeyEngine);
       else
@@ -332,7 +330,6 @@ function configSecureContext(context, options = kEmptyObject, name = 'options')
   }
 
   if (typeof clientCertEngine === 'string') {
-    emitOpenSSLEngineDeprecation();
     if (typeof context.setClientCertEngine !== 'function')
       throw new ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED();
     else
diff --git a/test/addons/openssl-client-cert-engine/test.js b/test/addons/openssl-client-cert-engine/test.js
index bad751202ca..77fef53e84f 100644
--- a/test/addons/openssl-client-cert-engine/test.js
+++ b/test/addons/openssl-client-cert-engine/test.js
@@ -26,12 +26,6 @@ const agentKey = fs.readFileSync(fixture.path('/keys/agent1-key.pem'));
 const agentCert = fs.readFileSync(fixture.path('/keys/agent1-cert.pem'));
 const agentCa = fs.readFileSync(fixture.path('/keys/ca1-cert.pem'));
 
-common.expectWarning({
-  DeprecationWarning: {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
 const serverOptions = {
   key: agentKey,
   cert: agentCert,
diff --git a/test/addons/openssl-key-engine/test.js b/test/addons/openssl-key-engine/test.js
index db05b6cea62..187f95b5141 100644
--- a/test/addons/openssl-key-engine/test.js
+++ b/test/addons/openssl-key-engine/test.js
@@ -26,12 +26,6 @@ const agentKey = fs.readFileSync(fixture.path('/keys/agent1-key.pem'));
 const agentCert = fs.readFileSync(fixture.path('/keys/agent1-cert.pem'));
 const agentCa = fs.readFileSync(fixture.path('/keys/ca1-cert.pem'));
 
-common.expectWarning({
-  DeprecationWarning: {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
 const serverOptions = {
   key: agentKey,
   cert: agentCert,
diff --git a/test/parallel/test-crypto-dep0183.js b/test/parallel/test-crypto-dep0183.js
deleted file mode 100644
index c0b9a8e9f67..00000000000
--- a/test/parallel/test-crypto-dep0183.js
+++ /dev/null
@@ -1,22 +0,0 @@
-'use strict';
-
-const common = require('../common');
-if (!common.hasCrypto)
-  common.skip('missing crypto');
-
-const assert = require('assert');
-const crypto = require('crypto');
-
-common.expectWarning({
-  DeprecationWarning: {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
-assert.throws(
-  () => crypto.setEngine('nodejs-test-invalid-engine'),
-  (err) => {
-    return err.code === 'ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED' ||
-           err.code === 'ERR_CRYPTO_ENGINE_UNKNOWN';
-  },
-);
diff --git a/test/parallel/test-tls-clientcertengine-unsupported.js b/test/parallel/test-tls-clientcertengine-unsupported.js
index aa0bf4a18d6..0d24005dc0a 100644
--- a/test/parallel/test-tls-clientcertengine-unsupported.js
+++ b/test/parallel/test-tls-clientcertengine-unsupported.js
@@ -6,15 +6,6 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-
-common.expectWarning({
-  'internal/test/binding':
-    'These APIs are for internal testing only. Do not use them.',
-  'DeprecationWarning': {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
 // Monkey-patch SecureContext
 const { internalBinding } = require('internal/test/binding');
 const binding = internalBinding('crypto');
diff --git a/test/parallel/test-tls-error-stack.js b/test/parallel/test-tls-error-stack.js
index 0a952a46bdd..02021b060ec 100644
--- a/test/parallel/test-tls-error-stack.js
+++ b/test/parallel/test-tls-error-stack.js
@@ -8,19 +8,12 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const tls = require('tls');
 
-const secureContext = tls.createSecureContext();
-if (typeof secureContext.context.setClientCertEngine !== 'function')
-  common.skip('OpenSSL dropped engine support');
-
-common.expectWarning({
-  DeprecationWarning: {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
 assert.throws(() => {
   tls.createSecureContext({ clientCertEngine: 'x' });
 }, (err) => {
+  if (err.code === 'ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED')
+    common.skip('OpenSSL dropped engine support');
+
   return err.name === 'Error' &&
          /could not load the shared library/.test(err.message) &&
          Array.isArray(err.opensslErrorStack) &&
diff --git a/test/parallel/test-tls-keyengine-unsupported.js b/test/parallel/test-tls-keyengine-unsupported.js
index 3473fe533f2..5fcfe495d51 100644
--- a/test/parallel/test-tls-keyengine-unsupported.js
+++ b/test/parallel/test-tls-keyengine-unsupported.js
@@ -6,15 +6,6 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-
-common.expectWarning({
-  'internal/test/binding':
-    'These APIs are for internal testing only. Do not use them.',
-  'DeprecationWarning': {
-    DEP0183: 'OpenSSL engine-based APIs are deprecated.',
-  },
-});
-
 // Monkey-patch SecureContext
 const { internalBinding } = require('internal/test/binding');
 const binding = internalBinding('crypto');