GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — doc: document that an empty OPENSSL_CONF skips config loading by orgads · Pull Request #64949 · nodejs/node

Conversation

orgads commented Aug 2, 2026 •

edited by panva

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

OpenSSL is initialized with CONF_MFLAGS_IGNORE_MISSING_FILE, so a missing configuration file does not prevent Node.js from starting.

That flag only covers ENOENT and ENOTDIR though, so a file that exists but cannot be opened is still fatal. Running in a container where /etc/ssl is not accessible to the current user aborts startup with an error that gives no way out:

  OpenSSL configuration error:
  ...:BIO_new_file:Permission denied:...fopen(/etc/ssl/openssl.cnf, rb)

There is a way out: OpenSSL skips config loading entirely when OPENSSL_CONF is set to an empty value. Say so in the error message, along with the options that select a different file, and document the empty value.

Closes: #62230

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nodejs-github-bot commented Aug 2, 2026

Copy link

Copy Markdown

Collaborator

Review requested:

@nodejs/startup

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot added c++

Issues and PRs that require attention from people who are familiar with C++.

needs-ci PRs that need a full CI run. labels

Aug 2, 2026

orgads force-pushed the openssl-conf-unreadable branch 2 times, most recently from dccd16f to 1480dd6 Compare

August 2, 2026 06:16

codecov Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.28%. Comparing base (6c862f4) to head (096ad5b).
⚠️ Report is 235 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64949      +/-   ##
==========================================
- Coverage   90.29%   90.28%   -0.01%     
==========================================
  Files         759      759              
  Lines      248295   248295              
  Branches    46861    46858       -3     
==========================================
- Hits       224205   224184      -21     
+ Misses      15517    15515       -2     
- Partials     8573     8596      +23

see 26 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

orgads force-pushed the openssl-conf-unreadable branch from 1480dd6 to e9e2c31 Compare

August 2, 2026 15:06

panva commented Aug 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

I'm not certain hiding an error reading something that may (or may not, i haven't done that due dilligence) be a convention and openssl default is a good idea.

Making the error clearer I'd have no issue with.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

orgads commented Aug 2, 2026

Copy link

Copy Markdown

Contributor Author

I'm not certain hiding an error reading something that may (or may not, i haven't done that due dilligence) be a convention and openssl default is a good idea.

Making the error clearer I'd have no issue with.

CONF_MFLAGS_IGNORE_MISSING_FILE is already set above, so a missing default config is fine. But OpenSSL only honours that flag for ENOENT/ENOTDIR - every other errno becomes BIO_R_SYS_LIB and stays fatal. Absent /etc/ssl/openssl.cnf works; the same file one chmod away kills startup. That asymmetry looks accidental, not deliberate.

The branch only fires when neither OPENSSL_CONF nor --openssl-config was given, i.e. the compiled-in OPENSSLDIR path. Explicit configs and their .includes stay fatal, so the FIPS reasoning above is untouched.

Does that address your concern? If you'd still rather not have it silent, I can print the error to stderr as a warning and continue.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

panva commented Aug 6, 2026

Copy link

Copy Markdown

Member

Setting OPENSSL_CONF= (empty) already skips config loading without touching the filesystem, so docker run -e OPENSSL_CONF= … works today.

And I don't think the FIPS argument holds — the default openssl.cnf is where .include fipsmodule.cnf usually lives, which is what #38732 made fatal. With this, a FIPS host whose config becomes unreadable would just start without FIPS.

I'd rather keep it fatal and mention OPENSSL_CONF in the error message, plus document that an empty value skips loading.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

orgads force-pushed the openssl-conf-unreadable branch from e9e2c31 to d76097d Compare

August 6, 2026 20:05

orgads changed the title ~~src: don't fail startup on unreadable OpenSSL config~~ src: hint at OPENSSL_CONF when the OpenSSL config fails to load

Aug 6, 2026

orgads force-pushed the openssl-conf-unreadable branch from d76097d to 0d8303f Compare

August 6, 2026 20:10

orgads commented Aug 6, 2026

Copy link

Copy Markdown

Contributor Author

You're right on both counts - OPENSSL_CONF= short-circuits before the file is opened, and the FIPS .include does live in the default config, so my argument missed the case that matters.

Reworked: the error stays fatal, and now says to point OPENSSL_CONF or --openssl-config=file at another file, or set OPENSSL_CONF= (empty) to start without one. Documented that last bit too. PTAL.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

panva commented Aug 6, 2026

Copy link

Copy Markdown

Member

I'd drop the src/node.cc change entirely and land this as docs only. The OpenSSL error already names the file and the reason, and the message change fires for every config error, including parse failures where "start without one" is the wrong advice if the file sets up FIPS.

If the variable is set to an empty value, Node.js starts without loading any
OpenSSL configuration file. This is a way past a default configuration file
that exists but cannot be read, for example when `/etc/ssl` is not accessible
to the user Node.js runs as, which is otherwise fatal at startup. No
configuration is applied in that case, including any [FIPS mode][] setup the
file would have performed.

If the [`--openssl-config`][] command-line option is used, the environment
variable is ignored, and an empty value has no effect.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          doc: document that an empty OPENSSL_CONF skips config loading

096ad5b

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: nodejs#62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>

orgads force-pushed the openssl-conf-unreadable branch from 0d8303f to 096ad5b Compare

August 7, 2026 05:09

orgads commented Aug 7, 2026

Copy link

Copy Markdown

Contributor Author

Done. Dropped the src/node.cc change and took your wording verbatim.

I kept the test. It asserts only existing behaviour - unreadable default config is fatal, OPENSSL_CONF= starts - so it pins the escape hatch the docs now promise. Let me know if you'd rather this be strictly docs.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

panva changed the title ~~src: hint at OPENSSL_CONF when the OpenSSL config fails to load~~ doc: document that an empty OPENSSL_CONF skips config loading

Aug 7, 2026

panva approved these changes

Aug 7, 2026

View reviewed changes

panva added author ready

PRs with CI started, the required approvals, and no outstanding review comments.

request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels

Aug 7, 2026

github-actions Bot added request-ci-failed Starting CI with the request-ci label failed and requires manual intervention. and removed request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels

Aug 7, 2026

This comment was marked as outdated.

panva added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. and removed request-ci-failed

Starting CI with the request-ci label failed and requires manual intervention.

request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels

Aug 7, 2026

nodejs-github-bot commented Aug 7, 2026

Copy link

Copy Markdown

Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75610/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label

Aug 21, 2026

nodejs-github-bot merged commit a0c366c into nodejs:main

Aug 21, 2026

79 checks passed

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot commented Aug 21, 2026

Copy link

Copy Markdown

Collaborator

Landed in a0c366c

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label

Aug 21, 2026

orgads deleted the openssl-conf-unreadable branch

August 22, 2026 17:41

aduh95 pushed a commit that referenced this pull request

Aug 25, 2026


          doc: document that an empty OPENSSL_CONF skips config loading

e502f14

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: #62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>
PR-URL: #64949
Fixes: #62230
Reviewed-By: Filip Skokan <[email protected]>

aduh95 pushed a commit that referenced this pull request

Aug 25, 2026


          doc: document that an empty OPENSSL_CONF skips config loading

24cd694

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: #62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>
PR-URL: #64949
Fixes: #62230
Reviewed-By: Filip Skokan <[email protected]>

github-actions Bot mentioned this pull request

Aug 25, 2026

2026-08-26, Version 26.8.0 (Current) #65551

Merged

aduh95 pushed a commit that referenced this pull request

Aug 27, 2026


          doc: document that an empty OPENSSL_CONF skips config loading

5a0edb0

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: #62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>
PR-URL: #64949
Fixes: #62230
Reviewed-By: Filip Skokan <[email protected]>

github-actions Bot mentioned this pull request

Sep 7, 2026

2026-09-08, Version 24.21.0 'Krypton' (LTS) #65873

Merged

aduh95 pushed a commit that referenced this pull request

Sep 7, 2026


          doc: document that an empty OPENSSL_CONF skips config loading

6c3b6b9

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: #62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>
PR-URL: #64949
Fixes: #62230
Reviewed-By: Filip Skokan <[email protected]>

aduh95 pushed a commit that referenced this pull request

Sep 7, 2026


          doc: document that an empty OPENSSL_CONF skips config loading

45c4011

A default OpenSSL configuration file that exists but cannot be read is
fatal at startup: CONF_MFLAGS_IGNORE_MISSING_FILE only covers ENOENT
and ENOTDIR, so a container that mounts /etc/ssl inaccessible to the
user Node.js runs as cannot start at all.

OpenSSL skips config loading entirely when OPENSSL_CONF is set to an
empty value, which gets past this, but that was undocumented. Say so,
including that no configuration is applied, FIPS setup included.

Refs: #62230
Co-Authored-By: Claude Opus 5 <[email protected]>
Signed-off-by: Orgad Shaneh <[email protected]>
PR-URL: #64949
Fixes: #62230
Reviewed-By: Filip Skokan <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): skip OpenSSL default-config test with BoringSSL

3eef1ad

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): skip OpenSSL default-config test with BoringSSL

73f8a49

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): skip OpenSSL default-config test with BoringSSL

6ce0822

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (45-x-y) (#53780)

d6c54a1

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (43-x-y) (#53777)

39c5ed0

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (44-x-y) (#53779)

effe589

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

dsanders11 pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (main) (#53782)

7ae6e6a

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

Reviewers

panva

panva approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready

PRs with CI started, the required approvals, and no outstanding review comments.

c++

Issues and PRs that require attention from people who are familiar with C++.

needs-ci

PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Node fails to start if /etc/ssl is not accessible

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

orgads commented Aug 2, 2026 • edited by panva Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 2, 2026

Uh oh!

codecov Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

panva commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

orgads commented Aug 2, 2026

Uh oh!

panva commented Aug 6, 2026

Uh oh!

orgads commented Aug 6, 2026

Uh oh!

panva commented Aug 6, 2026

Uh oh!

orgads commented Aug 7, 2026

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented Aug 7, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

orgads commented Aug 2, 2026 •

edited by panva

Loading

Uh oh!

There was an error while loading. Please reload this page.

codecov Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

panva commented Aug 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.