I think so. Search this page (http://nodejs.org/api/tls.html) for rejectUnauthorized and you'll find it has two quite different meanings, depending on the use context. In one case (tls.connect) it defaults to true (the one I read) and in the other (tls.createSecurePair), it defaults to false. In this case, these options are being passed to tls_socket.connect.upgrade, which passes them to http://nodejs.org/api/crypto.html#crypto_crypto_createcredentials_details, which ignores it entirely. So it does absolutely nothing. Hmmm.