GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — crypto: support --use-system-ca on Windows by joyeecheung · Pull Request #56833 · nodejs/node

Conversation

@joyeecheung

@joyeecheung joyeecheung commented Jan 30, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This patch adds support for --use-system-ca on Windows, the
certificates are collected following Chromium's policy,
though the following are left as TODO and out of this patch.

  • Support for user-added intermediate certificates
  • Support for distrusted certificates

Since those aren't typically supported by other runtimes/tools
either, and what's implemented in this patch is sufficient for
enough use cases already.

Fixes: #51537

This PR re-implements #44532 but is based on the support added for macOS in #56599 with the following modifications to match Chromium's policy:

  1. We also collect certificates from local machine, enterprise policies and trusted people
  2. We check that the extended key usage (if it exists) is suitable for TLS use.

The first commit comes from #56832 to fix a leak from the macOS PR.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jupjohn and EmperorArthur reacted with hooray emoji
All reactions
  • 🎉 2 reactions
@nodejs-github-bot

nodejs-github-bot commented Jan 30, 2025

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Jan 30, 2025
@joyeecheung joyeecheung mentioned this pull request Jan 30, 2025
feat: added support for reading certificates from windows system store #44532
Closed
@joyeecheung
joyeecheung force-pushed the win-certs branch 3 times, most recently from c007259 to dc737dd Compare January 30, 2025 19:13
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jan 30, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jan 30, 2025
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@joyeecheung
joyeecheung force-pushed the win-certs branch from dc737dd to faf7592 Compare January 30, 2025 19:22
@joyeecheung joyeecheung added the semver-minor PRs that contain new features and should be released in the next minor version. label Jan 30, 2025
@joyeecheung
joyeecheung marked this pull request as ready for review January 30, 2025 19:23
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jan 30, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jan 30, 2025
@nodejs-github-bot

nodejs-github-bot commented Jan 30, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/64855/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jasnell
jasnell approved these changes Jan 30, 2025
View reviewed changes
@codecov

codecov Bot commented Jan 30, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.15%. Comparing base (4355b3f) to head (91db2b0).
Report is 11 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main   #56833   +/-   ##
=======================================
  Coverage   89.14%   89.15%           
=======================================
  Files         665      665           
  Lines      192846   192846           
  Branches    37147    37144    -3     
=======================================
+ Hits       171916   171926   +10     
- Misses      13696    13703    +7     
+ Partials     7234     7217   -17
Files with missing lines Coverage Δ
src/crypto/crypto_context.cc 67.49% <ø> (ø)

... and 27 files with indirect coverage changes
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@timja

timja commented Jan 30, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Nice work!

What sort of testing have you done on this? - I see the integration test added

I'll look to get someone on windows behind our ZScaler enterprise setup next week to test it.

(and potentially with https://github.com/timja/openjdk-intermediate-ca-reproducer both root -> leaf and root -> intermediate -> leaf, unless you've tested something similar)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung

joyeecheung commented Jan 31, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

What sort of testing have you done on this? - I see the integration test added

So far only the test I modified in test-native-certs.mjs - basically the same as the macOS test, just running it first to see that it fails, then adding that certificate locally to Windows, run the test and see that it works, and removing that certificate. From what I can tell the real-world use cases I have only require the root CA certificates from either local machine or the current users to be trusted. I will try verifying it a bit on my end.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung

joyeecheung commented Jan 31, 2025

Copy link
Copy Markdown
Member Author

I verified that this works for the environment that I have, which only require the root certificates to be added. I've left the intermediate CAs as a TODO since it seems many other tools do not support it either and is only needed for certain setups.

Fixed the linter complaints. @jasnell can you take a look again? Thanks
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@timja

timja commented Jan 31, 2025

Copy link
Copy Markdown
Contributor

I verified that this works for the environment that I have, which only require the root certificates to be added. I've left the intermediate CAs as a TODO since it seems many other tools do not support it either and is only needed for certain setups.

Chrome supports it somehow, not quite sure how it does it though, without the intermediate enterprise setups may not work properly as a lot of enterprises are using tools like ZScaler, (or other similar products) where you give the SaaS service an intermediate certificate that is trusted on your devices and then it resigns every certificate for each TLS endpoint you hit.

What tools specifically do you mean aren't supporting it? I expect the JDK is broken, Rust ecosystem generally I find works in this area.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung

joyeecheung commented Jan 31, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

without the intermediate enterprise setups may not work properly as a lot of enterprises are using tools like ZScaler, (or other similar products) where you give the SaaS service an intermediate certificate that is trusted on your devices and then it resigns every certificate for each TLS endpoint you hit.

Yes, I am aware, though this PR only aims to solve the other common case, where you are dealing with services from a organization/company/government that manages the certificates themselves instead of relying on a third-party SaaS. Hence the intermediate certificate use case is left as a TODO. I think that can be done in a follow-up PR instead, similar to the distrust store.

What tools specifically do you mean aren't supporting it?

From what I can tell, every Rust tool using the rustls-native-certs crate (which seems rather popular) would not work with intermediate certificates, because they only query the root certificates from the current user https://github.com/rustls/rustls-native-certs/blob/main/src/windows.rs (if this approach somehow works for the intermediate certificates, then this PR should also just work because this PR does even more than that, though I doubt it does).
timja reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung
crypto: support --use-system-ca on Windows
91db2b0 
This patch adds support for --use-system-ca on Windows, the
certificates are collected following Chromium's policy,
though the following are left as TODO and out of this patch.

- Support for user-added intermediate certificates
- Support for distrusted certificates

Since those aren't typically supported by other runtimes/tools
either, and what's implemented in this patch is sufficient for
enough use cases already.
@joyeecheung
joyeecheung force-pushed the win-certs branch from a1c8ab6 to 91db2b0 Compare February 6, 2025 18:46
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 6, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 6, 2025
@nodejs-github-bot

nodejs-github-bot commented Feb 6, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/65039/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot

nodejs-github-bot commented Feb 7, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/65048/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
RafaelGSS added a commit that referenced this pull request Apr 11, 2025
@RafaelGSS
2025-04-15, Version 22.15.0 'Jod' (LTS)
e1372dd 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
assert,util:
  * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370
benchmark:
  * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
  * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
test:
  * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
url:
  * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
RafaelGSS pushed a commit that referenced this pull request Apr 14, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
e1221a7 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request Apr 14, 2025
@RafaelGSS
2025-04-15, Version 22.15.0 'Jod' (LTS)
4a89476 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
assert,util:
  * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370
benchmark:
  * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
  * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
test:
  * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
url:
  * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
aduh95 pushed a commit that referenced this pull request Apr 14, 2025
@RaisinTen @aduh95
doc: add history info for --use-system-ca
f57f665 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
aduh95 pushed a commit that referenced this pull request Apr 15, 2025
@RaisinTen @aduh95
doc: add history info for --use-system-ca
fa2b6c6 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request Apr 15, 2025
@RafaelGSS
2025-04-16, Version 22.15.0 'Jod' (LTS)
78b1312 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
assert,util:
  * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370
benchmark:
  * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
  * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
test:
  * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
url:
  * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
RafaelGSS pushed a commit that referenced this pull request Apr 16, 2025
@joyeecheung @RafaelGSS
crypto: support --use-system-ca on Windows
03a0f3a 
This patch adds support for --use-system-ca on Windows, the
certificates are collected following Chromium's policy,
though the following are left as TODO and out of this patch.

- Support for user-added intermediate certificates
- Support for distrusted certificates

Since those aren't typically supported by other runtimes/tools
either, and what's implemented in this patch is sufficient for
enough use cases already.

PR-URL: #56833
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 16, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
c5cafd6 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request Apr 16, 2025
@RafaelGSS
2025-04-16, Version 22.15.0 'Jod' (LTS)
8857843 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
assert,util:
  * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370
benchmark:
  * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
RafaelGSS pushed a commit that referenced this pull request Apr 17, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
fef3f82 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request Apr 18, 2025
@RafaelGSS
2025-04-16, Version 22.15.0 'Jod' (LTS)
03c6b98 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
assert,util:
  * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370
benchmark:
  * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
RafaelGSS added a commit that referenced this pull request Apr 18, 2025
@RafaelGSS
2025-04-23, Version 22.15.0 'Jod' (LTS)
b009466 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
UlisesGascon pushed a commit that referenced this pull request Apr 23, 2025
@RafaelGSS @UlisesGascon
2025-04-23, Version 22.15.0 'Jod' (LTS)
71f8c3b 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
This was referenced Apr 23, 2025
Self signed SSL Certificate support for DevContainers microsoft/vscode-remote-release#6092
Open
Read root certificates from OS cert stores devcontainers/cli#412
Open
RafaelGSS pushed a commit that referenced this pull request May 1, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
a453eb8 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request May 1, 2025
@RafaelGSS
2025-04-23, Version 22.15.0 'Jod' (LTS)
bb859fd 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
RafaelGSS pushed a commit that referenced this pull request May 2, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
51076f2 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS added a commit that referenced this pull request May 2, 2025
@RafaelGSS
2025-04-23, Version 22.15.0 'Jod' (LTS)
9f6d6ed 
Notable changes:

assert:
  * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370
  * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370
cli:
  * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
crypto:
  * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
  * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833
  * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599
deps:
  * update timezone to 2025a (Node.js GitHub Bot) #56876
deps,tools:
  * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100
dns:
  * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983
doc:
  * add @geeksilva97 to collaborators (Edy Silva) #57241
module:
  * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
  * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698
process:
  * (SEMVER-MINOR) add execve (Paolo Insogna) #56496
  * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490
  * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790
src:
  * set signal inspector io thread name (RafaelGSS) #56416
  * set thread name for main thread and v8 worker (RafaelGSS) #56416
  * set worker thread name using worker.name (RafaelGSS) #56416
  * use a default thread name for inspector (RafaelGSS) #56416
tls:
  * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107
util:
  * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462
v8:
  * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146
zlib:
  * (SEMVER-MINOR) add zstd support (Jan Martin) #52100

PR-URL: #57840
This was referenced May 15, 2025
Create an environment variable as an alternative to the --use-system-ca CLI flag nodejs/node-gyp#3162
Closed
Create an environment variable as an alternative to the --use-system-ca CLI flag #58346
Closed
@joyeecheung joyeecheung mentioned this pull request Jul 8, 2025
Tracking issue: custom CA certificate support #58990
Open
11 of 16 tasks
@maxious maxious mentioned this pull request Dec 23, 2025
Use local SSL trust store anomalyco/opencode#1694
Closed
@AlCalzone AlCalzone mentioned this pull request May 13, 2026
Consider further Node.js version bumps zwave-js/zwave-js#8820
Closed
@andreaschiappacasse andreaschiappacasse mentioned this pull request Oct 16, 2026
Use System Root CA Store on Windows aws/aws-cli#6193
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. semver-minor PRs that contain new features and should be released in the next minor version.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Use system certificate store when running under Windows

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@joyeecheung @nodejs-github-bot @timja @jasnell
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.