There is problem in forcing cipher order with SNI

honor-cipher-order-sni-problem.js

#!/usr/bin/env node
var tls = require('tls');
var crypto = require('crypto');

function b64decode(encoded) {
    return new Buffer(encoded || '', 'base64').toString('utf8');
};

var ciphers = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";

var keys = {
    "key": b64decode("LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeXpNSS9pdUdaTHgwOS9BMWdzaGQ1ZlorL2FJSnoyd3Y4SjFaSldjSitmSFJkdEsyClZVSU1xTXF2SGRTTFJydi9TUjUvSjlhbXZNSTZ6UDVRMm5JTHVxQk8rNmJEdVduRlQzU1RGUGl1SmlibGFUdm0KSTdsQ2pteHZURHpTWnkrdXc2Ti9CTjdVbk5uT2dTM3NwTGVOV2dWL1NYRkw4Y1JJcm83NitUU2hzL1lNQWl1NApmc1JxRFZEbnU1RVdlR3phTHdHTUFNT2lwSFQ2NlVnNWNhd1RxOXdRbVNrelhoVHplWWlnczdnekVVZWQ2V2ZiClZqTUJhN0lHS0k1RHdnbFVOZ1l2dHRvNzhocFU1WEYxK0xKbjZpc05ZcFQ4WFFMOVI0dFZmTm4wRnhXL1dNaUMKbjRNSFJmckROM2tRUTlvV1RqcHA5c3hXbmtOQ3g5dUpnV1BsNFFJREFRQUJBb0lCQVFDS0E0cnJIK0x6VHZGZgphZDdlaW5zRWM2MERWbWkxWXJVWkI3YUI2ZjlqcmJSb3NXdTRjdGtvV0NvaTU3Y0ZmekZBbDU4a0R1NUhMT0ZGClZNTFQ3RHc5TVI4VVc4dDZodlhHSnRhem1zaW1EeXNvazgrWG1nQXp2a0RHRmxXT1VsdXdjNzhWTHNoWUZMUG4KRjZzd29aODNjcDVtNHJZRGF4ODJ1TlNNS1F4ZnJ0dmJuTUhLOUNBZ0IrbVQxcDRBQTB6TVZna3VQQmdPaEtpVgpiVjFxczQ3UENsV2tDVTBtdEJ4SWVTT2xsY1Y4RDFSeWt3NHN6SU5QbkJ0M25UNFdBMzE2TTJBWVJTSGxkSkZhCitFaFhwYXU1WGtyQXVPV09uVDhRczZFaTJHNHl0L0N3R2dmSWU2Z1NwMHVtUXVtVWI5QWJMVWlMeXFKUkc4V1UKdjdJeUFJZXhBb0dCQU9SWVF5S1N4eU1UOGZtK0lobVdiTU9aOHJ5clR4UDh2N2RTb1pxWjM0Qnh5aW1WVDNNSgpzRm1NNG5Md3pqTFdhNzVsMlk5WkttSEFoL01ZZzBZd1duSmphRUxXK0taOHJ4R2Q1d25LWW1LK054QzV0T25NClJmZHNublkyT1hNTUUvT3l0bjFBUllLcnVMVVNlTXQzSjVxYzZYc2VycnFLaEZISzJnajJMSnFOQW9HQkFPUFAKSmpsUm5qZGt0YTBaOXJvVjZJYmtkQUQ0WWhtbWp6bTRFNlBJWmRLUGdnUkpRV3VJOU8vN0gwN3ZlNS8wL1U2bgpybm5RY20wMUhyb2ZnTzQ5cCtSRXkzN2JnOGd1SklDRHJxNkEya3Jla05ldyt3c3dndmtLdmU2eEluWkxGRjBTClR1b2pNaXh1STVXQzYyU2YxSlFZUU53MFVSVG5jY1RNcEoydnY2MmxBb0dCQUtha2t6b2tEQmhaY2Zways5WFkKcGIrS0ZsQUNaVStjNFAwVTNNTkxFSVZZaGNVYkprUTZDZTBRbUNKeUFzbXZHaXAxZ2ZUUGlkS1ZBNkl4Zlh3Mwp4WW85YWRWOXRURXJSVWlDQ0I1cENLd3ZUVmh6YnNoQlA3NTJFcDhLcTVwK2NnRWpwM0o0K1VHSHVPRE1ma05lCnpoUlQ5MERXLzRVN21aMW5nUCtSU0xQeEFvR0FhSXE0ZE5kaXJ2TDFlSEdReXdhZ3hiNXpDYnJ5Y2VrQWt6RkoKT2dFTjBSbndSWDFFbTArbmI3V2pRWHNmRldHOUdPcFVaQ3huUm54NUZGcSt0Ulh3UlEzWkFPZEZ5NGg1VWN5YwpUaEp0bXF3V2RoVU9yNnpjZmVNVEZFV1BsZytRVWNIRUd5aDVydkFBUG0xdERxbFdTWHZ6ejlubVY1eDZsaUIvCmJxbW5ZYzBDZ1lCOGJSWmlleFlFN1BOb2MyMmVhUnVURzliZDZXdGtJamlQeTRZR2hnRVVlaFd4NXJMaU1Wc1AKZ0pJVFVFZE1KeEV5aDRybzJUL1R1NFR4bUI1VnZ3RkM4a3VweWlnaWlIMUxkRkQ4aFRienk0a3NLM2t5VEVCMQpPdTdYRWtOMUEwTjkvTFJzb1RpS1B5T0hGVkJzMmtEOEd3VGJOTzNZZjRzczh6cDYvS0pNaEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo="),
    "cert": b64decode("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMrekNDQWVPZ0F3SUJBZ0lKQUp1UmVqSVQ2dlh2TUEwR0NTcUdTSWIzRFFFQkJRVUFNQlF4RWpBUUJnTlYKQkFNTUNYUmxjM1F4TG1OdmJUQWVGdzB4TkRBek1EVXlNRFV6TXpWYUZ3MHlOREF6TURJeU1EVXpNelZhTUJReApFakFRQmdOVkJBTU1DWFJsYzNReExtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTXN6Q1A0cmhtUzhkUGZ3TllMSVhlWDJmdjJpQ2M5c0wvQ2RXU1ZuQ2ZueDBYYlN0bFZDREtqS3J4M1UKaTBhNy8wa2VmeWZXcHJ6Q09zeitVTnB5QzdxZ1R2dW13N2xweFU5MGt4VDRyaVltNVdrNzVpTzVRbzVzYjB3OAowbWN2cnNPamZ3VGUxSnpaem9FdDdLUzNqVm9GZjBseFMvSEVTSzZPK3ZrMG9iUDJEQUlydUg3RWFnMVE1N3VSCkZuaHMyaThCakFERG9xUjArdWxJT1hHc0U2dmNFSmtwTTE0VTgzbUlvTE80TXhGSG5lbG4yMVl6QVd1eUJpaU8KUThJSlZEWUdMN2JhTy9JYVZPVnhkZml5WitvckRXS1UvRjBDL1VlTFZYelo5QmNWdjFqSWdwK0RCMFg2d3pkNQpFRVBhRms0NmFmYk1WcDVEUXNmYmlZRmo1ZUVDQXdFQUFhTlFNRTR3SFFZRFZSME9CQllFRkV5VHUxM2taYnl5CmZJM2NNTEx3ZFdrUStLbzFNQjhHQTFVZEl3UVlNQmFBRkV5VHUxM2taYnl5ZkkzY01MTHdkV2tRK0tvMU1Bd0cKQTFVZEV3UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUZCUUFEZ2dFQkFGNm9MdFZXaGp6TmVnZDBReGFJb242NQpmekJZdDlNTUpKTXlIVlM0Rk1Db1IvaVpuQldhSm5GdHY4WDIyU05aU0N2TS9nNW1ZK2FvLzBMWmpsY1BxQUlsCnNrNEJoc0toR0d4dnlSSkRoeTVFSlVzdVNvRmt1SmNxdzJWL1VuRXk2UzFsbFNrbkdHVE01U0doTDBqOWJBdkUKYjMzd20rN1lYSVFJWTJ0MFJWa0Eva2h6S2ZNbmE1S0pMR1lJTVhtL2xYTnlaMCttK0JSZGlqUWg4VVlzcENjOApmTkNiZTdiOWlGcktGNjVqejE5czd3M09QY3NRY0lXc25kZHFwUkUrcUxRZ0E1T3IrU2lYYXZTdFhKVmh4V1pmCnJaejhGM2c4Z2FmTlVYYzByZmlNVXN3ajgrTDNYSFNBaTAzYi94UEI1Si91emhIcmRGWGkzaGUzZXNQdzFCWT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="),
    ciphers: ciphers, // this works

    honorCipherOrder: true, // works only for primary domain
};

var keys2 = {
    "key": b64decode("LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMnVCcm9GQkk2S2h5TmQvU2VDSHoybE42U0d1c2x6M2xYM0J6SURhOXg4OXFUS1VlCmEzWUNqVE9BRmNsQXdSb01SWGVJbW9zaE5TcVNHTCtHZVFBN25IamVHTEx6ZWh1VkNnM1FZekllUzlhMitXR3cKTGw5TE4xeWhpWnUwdlNiZFRwbTlUbmF1ZGgxNXIwaUNQUU5qNm5STEtUSFN3eXk4aGFtRjFQM0FWbS91dDZabgp1WG1rUjIwTVhpNHdST1NtTUNKNDdPTmQ5akNscHRwWnlQTm1DaDhtY2NReStZYlhGV1l1RUp5UmcrYTU5eTcxCjJycjRKU2lJc2t1R1BneVBINS9PMUZsUGp0ZXlodVRTeDF0QjFCZ3FRNFZvTEhGd2QwV2FzSUVBZFo2N1IzWDUKbmhnVDhTZ1ZGUll6K1l6Z3J4RlRLWjFGcHJITm05azFHeVVETHdJREFRQUJBb0lCQUZDS2pKQXRldWJDTldURgp1L2tnNVU3TnNRMjlNWUZsOFdXeFIydnZPTjZ4NEhmYnV0bm9Ud0FPbDI5czR6c3JqcUJ4WC84ZWUxWEpHSUdxCjJKem1EUW1ESUpjT0lySW9QQ3U2OFpmTzlYOEt2OEg4eEl3TDNPMitWR01DdlB0dHRib2FzS0tTNFpmdE9MM2IKZkxGZThnRndVY2dTNFcrWW9yYThydGExbVhVMGhQRGs1cVNMN1Z3VlhDYjNWOFFNckVnYUF2ZWtueGhNMTVScApQNUltVXNONlhLYmFIRDA1dWNoZ1Z6QVk5VXdqeTNNSDV0K2F1M0dPM2llQWpsT2hzcmc0b0Evck5qZTVrSVpCCk80eldXMHExbTVTcGFCd2VEV2dyaEs5M3pmWnlnbDVWRHZFOWI1QWV2dnZOS2loNWlpU29UQVgxT1FQTUZoaUUKNmZvSUVTRUNnWUVBOFdSdUtWVkYxNFhVODJuVUJjbWdlNXByVGpNWW5xclpCRlVBQk92Wml3aVpESTh2dTMxUQp2ZXlKUHd3b3lFdHI1aTgxTEQwUHdkSjl3UXgyRjFBbzZCU1Q5UnErVmFFT1Q3Q1JXYkdGNjN4aW9COWVaVGhEClNuSFNKSDIyVlltbXBLWVMrOGc0MFZuZFgrL3ZoM3N3Q2k3WXdJN2EzWEtpRVJ6dFBMWlNnVlVDZ1lFQTZCOHYKVk94T2NnUWFNbUtzSVVZWmt2SmliSHNmamw1elc5YnJENzRyUVViRU9JZURhQ25tYzM3SVRWSFF3d0oxRG85cwppbVZqN2ZjdVBsaEZOd0ZyMkFYMU55MUhMVnhtcVJ6ZzJiU2VidXFkdktWdjNmOEhCbjNHNDZ5OFY4MENlNWhECmVMeWxZR3pEYjFxYnd2c1RPWFNFcUFZTDFYSWczdUlVYU5mSlFuTUNnWUJxamR0MjBWWllFWkp6dERaTUs3bDAKZGpDQnYxcFJ4N2F1Qzl0TFVOU2hZN1V6YncweDVObzhTK28xYzJlWktubkJqUHNhd1FWd21EcThlWVN6TzhZaQowOXFQNmpNMFZ6aWJBcVRXZzk5S21JaHNpQXhCLy9qc0pwd05VWlNuNDNBMDQ3NGplRGxrYUJlcEhwK01IVnVTClV5V0lza1o0VS82b01TMmpqQk9WVlFLQmdFMldidW5CK3c2ZFZHeFhFeFlrS2xRMTlMUXlDNEE1RGZJNnltTisKdTFLY1p1WkdWYVF4clRnWnZyWXBqTkJDT0FKZjZuWHdJaERldUhSYWFQaFQzMHBiNDNWSUN5eWNZQ3hTM00ybwpVL1RiTTFKbE1obFFMM2I1LzhzR2FBWXBIcFZWZGVnYmxtTyt0eXkzYXEwbjQyc25DVmhvZlBnaHA5OFlUcDRrCjByOEZBb0dCQU85MGxTZlJ3a3hXZnF4dEdVOFo4Y3NBZ3FLdDZtQlJjaHh2TWZDN1NWYlg4MFpZa0JNSDRsQjAKb2NlYXVqdzRKOHVmK1R6cTJvR1VTTlR5T1MrRzVmeVZyT3RDZFY2clFXUjBVbmpUbWxnRERveUlNWEZjUGdkUApuVDJ2dnNzNkNCak9HUjhlelJaOEhXWmQyUXdhNE85YzRUa1pkUDFsMFU3MWJ0LytlSTdWCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="),
    "cert": b64decode("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMrekNDQWVPZ0F3SUJBZ0lKQUo5VFJOQTZQbEJoTUEwR0NTcUdTSWIzRFFFQkJRVUFNQlF4RWpBUUJnTlYKQkFNTUNYUmxjM1F5TG1OdmJUQWVGdzB4TkRBek1EVXlNRFV6TlRCYUZ3MHlOREF6TURJeU1EVXpOVEJhTUJReApFakFRQmdOVkJBTU1DWFJsYzNReUxtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTnJnYTZCUVNPaW9jalhmMG5naDg5cFRla2hyckpjOTVWOXdjeUEydmNmUGFreWxIbXQyQW8wemdCWEoKUU1FYURFVjNpSnFMSVRVcWtoaS9obmtBTzV4NDNoaXk4M29ibFFvTjBHTXlIa3ZXdHZsaHNDNWZTemRjb1ltYgp0TDBtM1U2WnZVNTJybllkZWE5SWdqMERZK3AwU3lreDBzTXN2SVdwaGRUOXdGWnY3cmVtWjdsNXBFZHRERjR1Ck1FVGtwakFpZU96alhmWXdwYWJhV2Nqelpnb2ZKbkhFTXZtRzF4Vm1MaENja1lQbXVmY3U5ZHE2K0NVb2lMSkwKaGo0TWp4K2Z6dFJaVDQ3WHNvYmswc2RiUWRRWUtrT0ZhQ3h4Y0hkRm1yQ0JBSFdldTBkMStaNFlFL0VvRlJVVwpNL21NNEs4UlV5bWRSYWF4elp2Wk5Sc2xBeThDQXdFQUFhTlFNRTR3SFFZRFZSME9CQllFRkliVHNNdG43cXQ3Cm5zZ3NHQytEc1k4ZFo4M05NQjhHQTFVZEl3UVlNQmFBRkliVHNNdG43cXQ3bnNnc0dDK0RzWThkWjgzTk1Bd0cKQTFVZEV3UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUZCUUFEZ2dFQkFDRmJRUWVVMGlzM1N4MmZXSFZkcnRoTQo1VEtySW9xY2g1UXhrTFcxNGovcFhuc1piVG8xYkV6ZnFQZ0EzS2w4UXZzUktuTUNkYUFiY3FQTlR1Tjgxak1XClRMSGl6Ykl3Y1N5VjlPWUh6UjJSSHd0aE5KTG81QloyUzJCYS9tSElHQjBKYlpQY3dsUll5ekJwMDZjZE5sNTUKQkc2WEdQYlVTT3FqM2lKRVJweHJVcERCME40YXdpVWptKzRLVlNaNFlFcXF4U3dvMmY1cmNTaThLRVZQZ3gzOQp4QXAxOC9QSENHZlNxOHRpUFFFRy8zMmRQamNSU2hkNXlJb01Bam9ocUhrNHE2SWxzRlgwMldEc1FiSk53NVBoCkdYaVBiYksvcy9wT0htd2pGd2NvaVV5cG1nN1ovQ2dYZDR0RlRHVkkrMU82eUxaRWwvWlhMWG5vYlZMMEVOTT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="),
    ciphers: ciphers, // this works

    // this should ultimately be sufficient
    honorCipherOrder: true,

    // below was added to simulate what _tls_wrap.js and to adapt how
    // crypto.js passes options - unfortunately it does not work
    secureOptions: require('constants').SSL_OP_CIPHER_SERVER_PREFERENCE
};

var config = {
    ssl: keys,
};

var loadedKeys = crypto.createCredentials(keys2).context;

config.ssl.SNICallback = function(hostname, cb) {
  var result = undefined;
  if(hostname === 'test2.com')
    result = loadedKeys;
  if (cb) // 0.11.5 and later
      return cb(null, result);
  return result; // 0.11.4 and earlier;
};


tls.createServer(config.ssl).listen(4000);