GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — crypto: support --use-system-ca on non-Windows and non-macOS by joyeecheung · Pull Request #57009 · nodejs/node

Conversation

@joyeecheung

@joyeecheung joyeecheung commented Feb 12, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

crypto: support --use-system-ca on non-Windows and non-macOS

On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

  • If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
    load from /etc/ssl/cert.pem
  • If SSL_CERT_DIR is used, load from all the files under
    SSL_CERT_DIR. Otherwise, load from all the files under
    /etc/ssl/certs

I've only checked Ubuntu and RHEL so far. It may be worth checking whether this works on other popular distributions - from what I can tell, though, it seems the hard-coded configurations always leads to default locations under /etc/ssl/, which seems to be a location that most Linux distros would either use or link to anyway - for example, Ubuntu symlinks all the managed certificates to files under /etc/ssl/certs, while RHEL 9 just bundles all managed certificates to /etc/ssl/certs/ca-bundle.crt, so the current approach would usually just work.

If this somehow turns out to be sufficient, we can come back adding specific fallbacks for other systems similar to what go does which is basically listing all the directories that are known to be used for this purpose - but from what I can tell this can be slow and lead to duplicates since they might get symlinked to each other, so ideally if X509_get_default_cert_dir() and X509_get_default_cert_file() works on a platform, it's better not to look further to avoid unnecessary costs.

There is also the question of whether we should use NSS shared DB, like what Chrome does, but since most command line tools rely on the directory/file-based system-wide storage instead (like go listed above, and e.g. every rust tool using the rustls-native-certs crate), and it seems to be losing the point if we statically link NSS, I didn't go with this route. In any case it seems various distros already consolidates the NSS shared DB somehow into these default locations when they manage their certificate stores, or at least NSS DB can be loaded via environment variable overrides, so the current approach looks good enough.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
juanarbol, bricss, and pimterry reacted with heart emoji
All reactions
  • ❤️ 3 reactions
@nodejs-github-bot

nodejs-github-bot commented Feb 12, 2025

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/startup
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Feb 12, 2025
@joyeecheung
joyeecheung force-pushed the certs-others branch from 4a711b4 to c455c04 Compare February 12, 2025 01:25
@joyeecheung
joyeecheung marked this pull request as draft February 12, 2025 01:25
@codecov

codecov Bot commented Feb 12, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

Attention: Patch coverage is 2.43902% with 40 lines in your changes missing coverage. Please review.

Project coverage is 89.09%. Comparing base (79f96b6) to head (76aaa29).
Report is 16 commits behind head on main.

Files with missing lines Patch % Lines
src/crypto/crypto_context.cc 2.43% 40 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #57009      +/-   ##
==========================================
- Coverage   89.10%   89.09%   -0.02%     
==========================================
  Files         665      665              
  Lines      193203   193245      +42     
  Branches    37220    37223       +3     
==========================================
+ Hits       172158   172167       +9     
- Misses      13771    13807      +36     
+ Partials     7274     7271       -3
Files with missing lines Coverage Δ
src/crypto/crypto_context.cc 65.19% <2.43%> (-2.84%) ⬇️

... and 24 files with indirect coverage changes
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung
joyeecheung force-pushed the certs-others branch from c455c04 to 2c44065 Compare February 13, 2025 21:35
@joyeecheung
joyeecheung marked this pull request as ready for review February 13, 2025 21:46
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 13, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 13, 2025
@nodejs-github-bot

nodejs-github-bot commented Feb 13, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/65194/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
joyeecheung
joyeecheung commented Feb 13, 2025
View reviewed changes
Comment thread src/crypto/crypto_context.cc Resolved

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung
joyeecheung force-pushed the certs-others branch 2 times, most recently from c78e1bb to 0d6c04a Compare February 13, 2025 23:46
@joyeecheung
crypto: support --use-system-ca on non-Windows and non-macOS
891de46 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs
@joyeecheung
joyeecheung force-pushed the certs-others branch from 0d6c04a to 891de46 Compare February 13, 2025 23:51
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 13, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 13, 2025
@nodejs-github-bot

nodejs-github-bot commented Feb 13, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/65196/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung

joyeecheung commented Feb 14, 2025

Copy link
Copy Markdown
Member Author

CI is green. @jasnell @addaleax maybe you'll be interested in reviewing this since you've reviewed support for other systems?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
richardlau
richardlau reviewed Feb 14, 2025
View reviewed changes
Comment thread doc/api/cli.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
@joyeecheung
joyeecheung force-pushed the certs-others branch from 20cff99 to 822e288 Compare February 14, 2025 14:55
@joyeecheung
fixup! crypto: support --use-system-ca on non-Windows and non-macOS
803ce60
@joyeecheung
joyeecheung force-pushed the certs-others branch from 822e288 to 803ce60 Compare February 14, 2025 14:55
richardlau
richardlau approved these changes Feb 14, 2025
View reviewed changes
@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 14, 2025
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Feb 14, 2025
@nodejs-github-bot

nodejs-github-bot commented Feb 14, 2025

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/65204/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jasnell
jasnell reviewed Feb 15, 2025
View reviewed changes
Comment thread src/crypto/crypto_context.cc Resolved

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Feb 15, 2025
@nodejs-github-bot
nodejs-github-bot merged commit 579fc67 into nodejs:main Feb 15, 2025
@nodejs-github-bot

nodejs-github-bot commented Feb 15, 2025

Copy link
Copy Markdown
Collaborator

Landed in 579fc67
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
targos pushed a commit that referenced this pull request Feb 17, 2025
@joyeecheung @targos
crypto: support --use-system-ca on non-Windows and non-macOS
b50fc42 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: #57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
acidiney pushed a commit to acidiney/node that referenced this pull request Feb 23, 2025
@joyeecheung @acidiney
crypto: support --use-system-ca on non-Windows and non-macOS
1fc1731 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: nodejs#57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
@github-actions github-actions Bot mentioned this pull request Feb 25, 2025
2025-02-26, Version 23.9.0 (Current) #57207
Merged
RaisinTen added a commit to RaisinTen/node that referenced this pull request Mar 13, 2025
@RaisinTen
doc: add history info for --use-system-ca
8eb659f 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  nodejs#56599 landed in v23.8.0.
- Windows support nodejs#56833
  landed in v23.8.0
- non-Windows and non-macOS support
  nodejs#57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
@RaisinTen RaisinTen mentioned this pull request Mar 13, 2025
doc: add history info for --use-system-ca #57432
Merged
nodejs-github-bot pushed a commit that referenced this pull request Mar 15, 2025
@RaisinTen
doc: add history info for --use-system-ca
e162783 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
aduh95 pushed a commit that referenced this pull request Mar 18, 2025
@RaisinTen @aduh95
doc: add history info for --use-system-ca
17ccf92 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 1, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
3b3f881 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
aduh95 pushed a commit that referenced this pull request Apr 2, 2025
@joyeecheung @aduh95
crypto: support --use-system-ca on non-Windows and non-macOS
6803668 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: #57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
aduh95 pushed a commit that referenced this pull request Apr 3, 2025
@joyeecheung @aduh95
crypto: support --use-system-ca on non-Windows and non-macOS
5b8bf99 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: #57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit to RafaelGSS/node that referenced this pull request Apr 8, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
2cea0cd 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  nodejs#56599 landed in v23.8.0.
- Windows support nodejs#56833
  landed in v23.8.0
- non-Windows and non-macOS support
  nodejs#57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: nodejs#57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
@aduh95 aduh95 mentioned this pull request Apr 11, 2025
2025-04-23, Version 22.15.0 'Jod' (LTS), @UlisesGascon prepared by @RafaelGSS #57840
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 14, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
e1221a7 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
aduh95 pushed a commit that referenced this pull request Apr 14, 2025
@RaisinTen @aduh95
doc: add history info for --use-system-ca
f57f665 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
aduh95 pushed a commit that referenced this pull request Apr 15, 2025
@RaisinTen @aduh95
doc: add history info for --use-system-ca
fa2b6c6 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 16, 2025
@joyeecheung @RafaelGSS
crypto: support --use-system-ca on non-Windows and non-macOS
71c8611 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: #57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 16, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
c5cafd6 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 17, 2025
@joyeecheung @RafaelGSS
crypto: support --use-system-ca on non-Windows and non-macOS
44b19ec 
On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

- If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
  load from /etc/ssl/cert.pem
- If SSL_CERT_DIR is used, load from all the files under
  SSL_CERT_DIR. Otherwise, load from all the files under
  /etc/ssl/certs

PR-URL: #57009
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 17, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
fef3f82 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS pushed a commit that referenced this pull request May 1, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
a453eb8 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
RafaelGSS pushed a commit that referenced this pull request May 2, 2025
@RaisinTen @RafaelGSS
doc: add history info for --use-system-ca
51076f2 
These are the PRs for --use-system-ca:
- initial implementation of the option with just macOS support
  #56599 landed in v23.8.0.
- Windows support #56833
  landed in v23.8.0
- non-Windows and non-macOS support
  #57009 landed in v23.9.0

This change documents the history info.

Signed-off-by: Darshan Sen <[email protected]>
PR-URL: #57432
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
@joyeecheung joyeecheung mentioned this pull request Jul 8, 2025
Tracking issue: custom CA certificate support #58990
Open
11 of 16 tasks
@coderabbitai coderabbitai Bot mentioned this pull request Jun 8, 2026
Enhance site settings, error handling, and testing across components Chaimanat2546/baan-pool-villa#70
Merged
@coderabbitai coderabbitai Bot mentioned this pull request Aug 10, 2026
docs: add docs for network.rules aliyun-fc/fc-docs#115
Merged
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes
@richardlau richardlau richardlau approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. commit-queue-squash PRs the Commit Queue should land as one squashed commit. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@joyeecheung @nodejs-github-bot @jasnell @richardlau
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.