tls: add unsupported renegotiation error

doc/api/errors.md

@@ -3132,6 +3132,13 @@ Failed to set PSK identity hint. Hint may be too long.
 An attempt was made to renegotiate TLS on a socket instance with renegotiation
 disabled.
 
+<a id="ERR_TLS_RENEGOTIATION_UNSUPPORTED"></a>
+
+### `ERR_TLS_RENEGOTIATION_UNSUPPORTED`
+
+An attempt was made to renegotiate TLS, but the TLS implementation does not
+support caller-initiated renegotiation.
+
 <a id="ERR_TLS_REQUIRED_SERVER_NAME"></a>
 
 ### `ERR_TLS_REQUIRED_SERVER_NAME`

lib/internal/errors.js

@@ -1843,6 +1843,8 @@ E('ERR_TLS_PROTOCOL_VERSION_CONFLICT',
   'TLS protocol version %j conflicts with secureProtocol %j', TypeError);
 E('ERR_TLS_RENEGOTIATION_DISABLED',
   'TLS session renegotiation disabled for this socket', Error);
+E('ERR_TLS_RENEGOTIATION_UNSUPPORTED',
+  'TLS session renegotiation is unsupported by this TLS implementation', Error);
 
 // This should probably be a `TypeError`.
 E('ERR_TLS_REQUIRED_SERVER_NAME',

lib/internal/tls/wrap.js

@@ -72,6 +72,7 @@ const {
     ERR_TLS_INVALID_CONTEXT,
     ERR_TLS_INVALID_STATE,
     ERR_TLS_RENEGOTIATION_DISABLED,
+    ERR_TLS_RENEGOTIATION_UNSUPPORTED,
     ERR_TLS_REQUIRED_SERVER_NAME,
     ERR_TLS_SESSION_ATTACK,
     ERR_TLS_SNI_FROM_SERVER,
@@ -1014,8 +1015,13 @@ TLSSocket.prototype.renegotiate = function(options, callback) {
   try {
     this._handle.renegotiate();
   } catch (err) {
+    const isBoringSSLRenegotiationUnsupported =
+      process.features.openssl_is_boringssl &&
+      err?.code === 'ERR_SSL_FUNCTION_SHOULD_NOT_HAVE_BEEN_CALLED';
+    const error = isBoringSSLRenegotiationUnsupported ?
+      new ERR_TLS_RENEGOTIATION_UNSUPPORTED() : err;
     if (callback) {
-      process.nextTick(callback, err);
+      process.nextTick(callback, error);
     }
     return false;
   }

test/addons/openssl-get-ssl-ctx/binding.cc

@@ -18,12 +18,12 @@ void GetSSLCtx(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  // Verify the pointer is a valid SSL_CTX by calling an OpenSSL function.
-  const SSL_METHOD* method = SSL_CTX_get_ssl_method(ctx);
-  if (method == nullptr) {
+  // Verify the pointer is a valid SSL_CTX by calling a function available
+  // across OpenSSL-compatible TLS backends and checking context-owned state.
+  STACK_OF(SSL_CIPHER)* ciphers = SSL_CTX_get_ciphers(ctx);
+  if (ciphers == nullptr) {
     isolate->ThrowException(v8::Exception::Error(
-        v8::String::NewFromUtf8(isolate,
-                                "SSL_CTX_get_ssl_method returned nullptr")
+        v8::String::NewFromUtf8(isolate, "SSL_CTX_get_ciphers returned nullptr")
             .ToLocalChecked()));
     return;
   }