crypto: support --use-system-ca on non-Windows and non-macOS #57009

joyeecheung · 2025-02-12T01:25:02Z

crypto: support --use-system-ca on non-Windows and non-macOS

On other platforms, load from the OpenSSL default certificate
file and diretory.
This is different from --use-openssl-ca in that it caches
the certificates on first load, instead of always reading
from disk every time a new root store is needed.

When used together with the statically-linked OpenSSL, the
default configuration usually leads to this behavior:

If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise
load from /etc/ssl/cert.pem
If SSL_CERT_DIR is used, load from all the files under
SSL_CERT_DIR. Otherwise, load from all the files under
/etc/ssl/certs

I've only checked Ubuntu and RHEL so far. It may be worth checking whether this works on other popular distributions - from what I can tell, though, it seems the hard-coded configurations always leads to default locations under /etc/ssl/, which seems to be a location that most Linux distros would either use or link to anyway - for example, Ubuntu symlinks all the managed certificates to files under /etc/ssl/certs, while RHEL 9 just bundles all managed certificates to /etc/ssl/certs/ca-bundle.crt, so the current approach would usually just work.

If this somehow turns out to be sufficient, we can come back adding specific fallbacks for other systems similar to what go does which is basically listing all the directories that are known to be used for this purpose - but from what I can tell this can be slow and lead to duplicates since they might get symlinked to each other, so ideally if X509_get_default_cert_dir() and X509_get_default_cert_file() works on a platform, it's better not to look further to avoid unnecessary costs.

There is also the question of whether we should use NSS shared DB, like what Chrome does, but since most command line tools rely on the directory/file-based system-wide storage instead (like go listed above, and e.g. every rust tool using the rustls-native-certs crate), and it seems to be losing the point if we statically link NSS, I didn't go with this route. In any case it seems various distros already consolidates the NSS shared DB somehow into these default locations when they manage their certificate stores, or at least NSS DB can be loaded via environment variable overrides, so the current approach looks good enough.

nodejs-github-bot · 2025-02-12T01:25:06Z

Review requested:

@nodejs/crypto
@nodejs/startup

codecov · 2025-02-12T02:32:00Z

Codecov Report

Attention: Patch coverage is 2.43902% with 40 lines in your changes missing coverage. Please review.

Project coverage is 89.09%. Comparing base (79f96b6) to head (76aaa29).
Report is 16 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_context.cc	2.43%	40 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #57009      +/-   ##
==========================================
- Coverage   89.10%   89.09%   -0.02%     
==========================================
  Files         665      665              
  Lines      193203   193245      +42     
  Branches    37220    37223       +3     
==========================================
+ Hits       172158   172167       +9     
- Misses      13771    13807      +36     
+ Partials     7274     7271       -3

Files with missing lines	Coverage Δ
src/crypto/crypto_context.cc	`65.19% <2.43%> (-2.84%)`	⬇️

... and 24 files with indirect coverage changes

nodejs-github-bot · 2025-02-13T21:53:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/65194/

src/crypto/crypto_context.cc

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs

nodejs-github-bot · 2025-02-13T23:59:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/65196/

joyeecheung · 2025-02-14T11:09:53Z

CI is green. @jasnell @addaleax maybe you'll be interested in reviewing this since you've reviewed support for other systems?

doc/api/cli.md

nodejs-github-bot · 2025-02-14T16:53:15Z

CI: https://ci.nodejs.org/job/node-test-pull-request/65204/

src/crypto/crypto_context.cc

nodejs-github-bot · 2025-02-15T15:50:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/65221/

nodejs-github-bot · 2025-02-15T20:34:39Z

CI: https://ci.nodejs.org/job/node-test-pull-request/65234/

nodejs-github-bot · 2025-02-15T22:54:32Z

Landed in 579fc67

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs PR-URL: #57009 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs PR-URL: nodejs#57009 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support nodejs#56599 landed in v23.8.0. - Windows support nodejs#56833 landed in v23.8.0 - non-Windows and non-macOS support nodejs#57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs PR-URL: #57009 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support nodejs#56599 landed in v23.8.0. - Windows support nodejs#56833 landed in v23.8.0 - non-Windows and non-macOS support nodejs#57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: nodejs#57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs PR-URL: #57009 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

On other platforms, load from the OpenSSL default certificate file and diretory. This is different from --use-openssl-ca in that it caches the certificates on first load, instead of always reading from disk every time a new root store is needed. When used together with the statically-linked OpenSSL, the default configuration usually leads to this behavior: - If SSL_CERT_FILE is used, load from SSL_CERT_FILE. Otherwise load from /etc/ssl/cert.pem - If SSL_CERT_DIR is used, load from all the files under SSL_CERT_DIR. Otherwise, load from all the files under /etc/ssl/certs PR-URL: #57009 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Feb 12, 2025

joyeecheung force-pushed the certs-others branch from 4a711b4 to c455c04 Compare February 12, 2025 01:25

joyeecheung marked this pull request as draft February 12, 2025 01:25

joyeecheung force-pushed the certs-others branch from c455c04 to 2c44065 Compare February 13, 2025 21:35

joyeecheung marked this pull request as ready for review February 13, 2025 21:46

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 13, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 13, 2025

joyeecheung commented Feb 13, 2025

View reviewed changes

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

joyeecheung force-pushed the certs-others branch 2 times, most recently from c78e1bb to 0d6c04a Compare February 13, 2025 23:46

joyeecheung force-pushed the certs-others branch from 0d6c04a to 891de46 Compare February 13, 2025 23:51

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 13, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 13, 2025

richardlau reviewed Feb 14, 2025

View reviewed changes

doc/api/cli.md Outdated Show resolved Hide resolved

joyeecheung force-pushed the certs-others branch from 20cff99 to 822e288 Compare February 14, 2025 14:55

fixup! crypto: support --use-system-ca on non-Windows and non-macOS

803ce60

joyeecheung force-pushed the certs-others branch from 822e288 to 803ce60 Compare February 14, 2025 14:55

richardlau approved these changes Feb 14, 2025

View reviewed changes

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 14, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 14, 2025

jasnell reviewed Feb 15, 2025

View reviewed changes

src/crypto/crypto_context.cc Show resolved Hide resolved

richardlau approved these changes Feb 15, 2025

View reviewed changes

joyeecheung added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. labels Feb 15, 2025

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Feb 15, 2025

nodejs-github-bot merged commit 579fc67 into nodejs:main Feb 15, 2025
61 checks passed

github-actions bot mentioned this pull request Feb 25, 2025

2025-02-26, Version 23.9.0 (Current) #57207

Merged

RaisinTen mentioned this pull request Mar 13, 2025

doc: add history info for --use-system-ca #57432

Merged

aduh95 mentioned this pull request Apr 11, 2025

2025-04-23, Version 22.15.0 'Jod' (LTS), @UlisesGascon prepared by @RafaelGSS #57840

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: support --use-system-ca on non-Windows and non-macOS #57009

crypto: support --use-system-ca on non-Windows and non-macOS #57009

joyeecheung commented Feb 12, 2025 •

edited

Loading

nodejs-github-bot commented Feb 12, 2025

codecov bot commented Feb 12, 2025 •

edited

Loading

nodejs-github-bot commented Feb 13, 2025

nodejs-github-bot commented Feb 13, 2025

joyeecheung commented Feb 14, 2025

nodejs-github-bot commented Feb 14, 2025

nodejs-github-bot commented Feb 15, 2025

nodejs-github-bot commented Feb 15, 2025

nodejs-github-bot commented Feb 15, 2025

crypto: support --use-system-ca on non-Windows and non-macOS #57009

crypto: support --use-system-ca on non-Windows and non-macOS #57009

Conversation

joyeecheung commented Feb 12, 2025 • edited Loading

nodejs-github-bot commented Feb 12, 2025

codecov bot commented Feb 12, 2025 • edited Loading

Codecov Report

nodejs-github-bot commented Feb 13, 2025

nodejs-github-bot commented Feb 13, 2025

joyeecheung commented Feb 14, 2025

nodejs-github-bot commented Feb 14, 2025

nodejs-github-bot commented Feb 15, 2025

nodejs-github-bot commented Feb 15, 2025

nodejs-github-bot commented Feb 15, 2025

joyeecheung commented Feb 12, 2025 •

edited

Loading

codecov bot commented Feb 12, 2025 •

edited

Loading