I suspect that most folk, such as myself, have blissfully skated past such issues in ignorance because using Node.js to field SSL traffic isn't the standard setup. Instead you run an http.Server - with or without Socket.IO latched to it - behind a websocket-capable, ssl-terminating proxy like HAProxy.

http://www.exratione.com/2012/12/websockets-over-ssl-haproxy...

Because you're going to need all the proxy features like failover, clustering, etc, etc, anyway, so why put Node.js right up front?

(Nginx recently added support for websockets, so that's now a viable alternative to HAProxy in this role, but it was aggravating for a while that it wasn't).