@@ -3142,21 +3142,18 @@ On platforms other than Windows and macOS, this loads certificates from the dire |
3142 | 3142 | and file trusted by OpenSSL, similar to `--use-openssl-ca`, with the difference being |
3143 | 3143 | that it caches the certificates after first load. |
3144 | 3144 |
|
3145 | | -On Windows and macOS, the certificate trust policy is planned to follow |
3146 | | -[Chromium's policy for locally trusted certificates][]: |
| 3145 | +On Windows and macOS, the certificate trust policy is similar to |
| 3146 | +[Chromium's policy for locally trusted certificates][], but with some differences: |
3147 | 3147 |
|
3148 | 3148 | On macOS, the following settings are respected: |
3149 | 3149 |
|
3150 | 3150 | * Default and System Keychains |
3151 | 3151 | * Trust: |
3152 | 3152 | * Any certificate where the “When using this certificate” flag is set to “Always Trust” or |
3153 | | - * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust.” |
3154 | | - * Distrust: |
3155 | | - * Any certificate where the “When using this certificate” flag is set to “Never Trust” or |
3156 | | - * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Never Trust.” |
| 3153 | + * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust”. |
| 3154 | + * The certificate must also be valid, with "X.509 Basic Policy" set to “Always Trust”. |
3157 | 3155 |
|
3158 | | -On Windows, the following settings are respected (unlike Chromium's policy, distrust |
3159 | | -and intermediate CA are not currently supported): |
| 3156 | +On Windows, the following settings are respected: |
3160 | 3157 |
|
3161 | 3158 | * Local Machine (accessed via `certlm.msc`) |
3162 | 3159 | * Trust: |
@@ -3171,8 +3168,11 @@ and intermediate CA are not currently supported): |
3171 | 3168 | * Trusted Root Certification Authorities |
3172 | 3169 | * Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities |
3173 | 3170 |
|
3174 | | -On Windows and macOS, Node.js would check that the user settings for the certificates |
3175 | | -do not forbid them for TLS server authentication before using them. |
| 3171 | +On Windows and macOS, Node.js would check that the user settings for the trusted |
| 3172 | +certificates do not forbid them for TLS server authentication before using them. |
| 3173 | + |
| 3174 | +Node.js currently does not support distrust/revocation of certificates |
| 3175 | +from another source based on system settings. |
3176 | 3176 |
|
3177 | 3177 | On other systems, Node.js loads certificates from the default certificate file |
3178 | 3178 | (typically `/etc/ssl/cert.pem`) and default certificate directory (typically |
|