Skip to content

test: send SNI in CA certificate test - #66835

Open
tamird wants to merge 1 commit into
nodejs:mainfrom
tamird:test-tls-add-ca-sni
Open

tamird wants to merge 1 commit into
nodejs:mainfrom
tamird:test-tls-add-ca-sni

Conversation

@tamird

@tamird tamird commented Oct 18, 2026

Copy link
Copy Markdown

Set servername when connecting to www.nodejs.org so the server selects its certificate for that hostname. Without SNI, it returns a certificate that does not cover www.nodejs.org, and the test fails before exercising CA handling. The nightly internet test is failing with this error 1.

Reproduce the certificate mismatch without Node.js:

    openssl s_client -connect www.nodejs.org:443 -noservername \
      -verify_hostname www.nodejs.org -verify_return_error </dev/null

This reports "verify error:num=62:Hostname mismatch". Replacing -noservername with -servername www.nodejs.org succeeds.

Set servername when connecting to www.nodejs.org so the server selects
its certificate for that hostname. Without SNI, it returns a certificate
that does not cover www.nodejs.org, and the test fails before exercising
CA handling. The nightly internet test is failing with this error [1].

Reproduce the certificate mismatch without Node.js:

    openssl s_client -connect www.nodejs.org:443 -noservername \
      -verify_hostname www.nodejs.org -verify_return_error </dev/null

This reports "verify error:num=62:Hostname mismatch". Replacing
-noservername with -servername www.nodejs.org succeeds.

[1]: https://github.com/nodejs/node/actions/runs/39084453901

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Assisted-by: Codex
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. test Issues and PRs related to Node.js core tests and test infrastructure. labels Oct 18, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

tamird added a commit to tamird/gvisor that referenced this pull request Oct 18, 2026
Link the retained runtime-image patch to nodejs/node#66835 so its upstream
status can be tracked. The patch hunk and image recipe are unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ci PRs that need a full CI run. test Issues and PRs related to Node.js core tests and test infrastructure.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants