Skip to content

crypto: support --use-system-ca on non-Windows and non-macOS #57009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nodejs-github-bot merged 3 commits into from
Feb 15, 2025
+111 −15
Merged

crypto: support --use-system-ca on non-Windows and non-macOS #57009

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
891de46
crypto: support --use-system-ca on non-Windows and non-macOS
joyeecheung Feb 10, 2025
803ce60
fixup! crypto: support --use-system-ca on non-Windows and non-macOS
joyeecheung Feb 14, 2025
76aaa29
fixup! fixup! crypto: support --use-system-ca on non-Windows and non-…
joyeecheung Feb 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fixup! crypto: support --use-system-ca on non-Windows and non-macOS
  • Loading branch information
@joyeecheung
joyeecheung committed Feb 14, 2025
commit 803ce60ec0d9c78ed14df1860d96101e88cdc8f8
33 changes: 19 additions & 14 deletions doc/api/cli.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2869,14 +2869,14 @@ The following values are valid for `mode`:

Node.js uses the trusted CA certificates present in the system store along with
the `--use-bundled-ca` option and the `NODE_EXTRA_CA_CERTS` environment variable.
On platform other than Windows and macOS, this loads certificates from the directory
On platforms other than Windows and macOS, this loads certificates from the directory
and file trusted by OpenSSL, similar to `--use-openssl-ca`, with the difference being
that it caches the certificates after first load.

This option is only supported on Windows and macOS, and the certificate trust policy
is planned to follow [Chromium's policy for locally trusted certificates][]:
On Windows and macOS, the certificate trust policy is planned to follow
[Chromium's policy for locally trusted certificates][]:

On macOS, the following certifcates are trusted:
On macOS, the following settings are respected:

* Default and System Keychains
* Trust:
Expand All @@ -2886,8 +2886,8 @@ On macOS, the following certifcates are trusted:
* Any certificate where the “When using this certificate” flag is set to “Never Trust” or
* Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Never Trust.”

On Windows, the following certificates are currently trusted (unlike
Chromium's policy, distrust is not currently supported):
On Windows, the following settings are respected (unlike Chromium's policy, distrust
and intermediate CA are not currently supported):

* Local Machine (accessed via `certlm.msc`)
* Trust:
Expand All @@ -2902,14 +2902,19 @@ Chromium's policy, distrust is not currently supported):
* Trusted Root Certification Authorities
* Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities

On Windows and macOS, Node.js would check that the certificate's key usage and extended key
usage are consistent with TLS use cases before using it for server authentication.

On other systems, Node.js loads certificates from the default file
(typically `/etc/ssl/cert.pem`) and default directory (typically `/etc/ssl/certs`)
that the version of OpenSSL that Node.js links to respects.
If the overriding OpenSSL environment variables (typically `SSL_CERT_FILE` and
`SSL_CERT_DIR`) are set, they will be used to load certificates from instead.
On Windows and macOS, Node.js would check that the user settings for the certificates
do not forbid them for TLS server authentication before using them.

On other systems, Node.js loads certificates from the default certificate file
(typically `/etc/ssl/cert.pem`) and default certificate directory (typically
`/etc/ssl/certs`) that the version of OpenSSL that Node.js links to respects.
This typically works with the convention on major Linux distributions and other
UNIX-like systems. If the overriding OpenSSL environment variables
(typically `SSL_CERT_FILE` and `SSL_CERT_DIR`, depending on the configuration
of the OpenSSL that Node.js links to) are set, the specified paths will be used to load
certificates instead. These environment variables can be used as workarounds
if the conventional paths used by the version of OpenSSL Node.js links to are
not consistent with the system configuration that the users have for some reason.

### `--v8-options`

Expand Down