Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit a1897c1

Browse filesBrowse files
AdamMajerItalo A. Casas
AdamMajer
authored and
Italo A. Casas
committed
crypto: ability to select cert store at runtime
PR-URL: #8334 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
1 parent eb7ee50 commit a1897c1
Copy full SHA for a1897c1

File tree

Expand file treeCollapse file tree

5 files changed

+94
-8
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

5 files changed

+94
-8
lines changed
Open diff view settings
Collapse file

‎doc/api/cli.md‎

Copy file name to clipboardExpand all lines: doc/api/cli.md
+36Lines changed: 36 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,24 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
243243
used to enable FIPS-compliant crypto if Node.js is built with
244244
`./configure --openssl-fips`.
245245

246+
### `--use-openssl-ca`, `--use-bundled-ca`
247+
<!-- YAML
248+
added: REPLACEME
249+
-->
250+
251+
Use OpenSSL's default CA store or use bundled Mozilla CA store as supplied by
252+
current NodeJS version. The default store is selectable at build-time.
253+
254+
Using OpenSSL store allows for external modifications of the store. For most
255+
Linux and BSD distributions, this store is maintained by the distribution
256+
maintainers and system administrators. OpenSSL CA store location is dependent on
257+
configuration of the OpenSSL library but this can be altered at runtime using
258+
environmental variables.
259+
260+
The bundled CA store, as supplied by NodeJS, is a snapshot of Mozilla CA store
261+
that is fixed at release time. It is identical on all supported platforms.
262+
263+
See `SSL_CERT_DIR` and `SSL_CERT_FILE`.
246264

247265
### `--icu-data-dir=file`
248266
<!-- YAML
@@ -336,6 +354,24 @@ misformatted, but any errors are otherwise ignored.
336354
Note that neither the well known nor extra certificates are used when the `ca`
337355
options property is explicitly specified for a TLS or HTTPS client or server.
338356

357+
### `SSL_CERT_DIR=dir`
358+
359+
If `--use-openssl-ca` is enabled, this overrides and sets OpenSSL's directory
360+
containing trusted certificates.
361+
362+
Note: Be aware that unless the child environment is explicitly set, this
363+
evironment variable will be inherited by any child processes, and if they use
364+
OpenSSL, it may cause them to trust the same CAs as node.
365+
366+
### `SSL_CERT_FILE=file`
367+
368+
If `--use-openssl-ca` is enabled, this overrides and sets OpenSSL's file
369+
containing trusted certificates.
370+
371+
Note: Be aware that unless the child environment is explicitly set, this
372+
evironment variable will be inherited by any child processes, and if they use
373+
OpenSSL, it may cause them to trust the same CAs as node.
374+
339375
[emit_warning]: process.html#process_process_emitwarning_warning_name_ctor
340376
[Buffer]: buffer.html#buffer_buffer
341377
[debugger]: debugger.html
Collapse file

‎doc/node.1‎

Copy file name to clipboardExpand all lines: doc/node.1
+25Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,22 @@ Load an OpenSSL configuration file on startup. Among other uses, this can be
171171
used to enable FIPS-compliant crypto if Node.js is built with
172172
\fB./configure \-\-openssl\-fips\fR.
173173

174+
.TP
175+
.BR \-\-use\-openssl\-ca,\-\-use\-bundled\-ca
176+
Use OpenSSL's default CA store or use bundled Mozilla CA store as supplied by
177+
current NodeJS version. The default store is selectable at build-time.
178+
179+
Using OpenSSL store allows for external modifications of the store. For most
180+
Linux and BSD distributions, this store is maintained by the distribution
181+
maintainers and system administrators. OpenSSL CA store location is dependent on
182+
configuration of the OpenSSL library but this can be altered at runtime using
183+
environmental variables.
184+
185+
The bundled CA store, as supplied by NodeJS, is a snapshot of Mozilla CA store
186+
that is fixed at release time. It is identical on all supported platforms.
187+
188+
See \fBSSL_CERT_DIR\fR and \fBSSL_CERT_FILE\fR.
189+
174190
.TP
175191
.BR \-\-icu\-data\-dir =\fIfile\fR
176192
Specify ICU data load path. (overrides \fBNODE_ICU_DATA\fR)
@@ -219,6 +235,15 @@ asynchronous when outputting to a TTY on platforms which support async stdio.
219235
Setting this will void any guarantee that stdio will not be interleaved or
220236
dropped at program exit. \fBAvoid use.\fR
221237

238+
.TP
239+
.BR SSL_CERT_DIR = \fIdir\fR
240+
If \fB\-\-use\-openssl\-ca\fR is enabled, this overrides and sets OpenSSL's directory
241+
containing trusted certificates.
242+
243+
.TP
244+
.BR SSL_CERT_FILE = \fIfile\fR
245+
If \fB\-\-use\-openssl\-ca\fR is enabled, this overrides and sets OpenSSL's
246+
file containing trusted certificates.
222247

223248
.SH BUGS
224249
Bugs are tracked in GitHub Issues:
Collapse file

‎src/node.cc‎

Copy file name to clipboardExpand all lines: src/node.cc
+22Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,14 @@ static const char* icu_data_dir = nullptr;
161161
bool no_deprecation = false;
162162

163163
#if HAVE_OPENSSL
164+
// use OpenSSL's cert store instead of bundled certs
165+
bool ssl_openssl_cert_store =
166+
#if defined(NODE_OPENSSL_CERT_STORE)
167+
true;
168+
#else
169+
false;
170+
#endif
171+
164172
# if NODE_FIPS_MODE
165173
// used by crypto module
166174
bool enable_fips_crypto = false;
@@ -3487,6 +3495,16 @@ static void PrintHelp() {
34873495
" --v8-pool-size=num set v8's thread pool size\n"
34883496
#if HAVE_OPENSSL
34893497
" --tls-cipher-list=val use an alternative default TLS cipher list\n"
3498+
" --use-bundled-ca use bundled CA store"
3499+
#if !defined(NODE_OPENSSL_CERT_STORE)
3500+
" (default)"
3501+
#endif
3502+
"\n"
3503+
" --use-openssl-ca use OpenSSL's default CA store"
3504+
#if defined(NODE_OPENSSL_CERT_STORE)
3505+
" (default)"
3506+
#endif
3507+
"\n"
34903508
#if NODE_FIPS_MODE
34913509
" --enable-fips enable FIPS crypto at startup\n"
34923510
" --force-fips force FIPS crypto (cannot be disabled)\n"
@@ -3650,6 +3668,10 @@ static void ParseArgs(int* argc,
36503668
#if HAVE_OPENSSL
36513669
} else if (strncmp(arg, "--tls-cipher-list=", 18) == 0) {
36523670
default_cipher_list = arg + 18;
3671+
} else if (strncmp(arg, "--use-openssl-ca", 16) == 0) {
3672+
ssl_openssl_cert_store = true;
3673+
} else if (strncmp(arg, "--use-bundled-ca", 16) == 0) {
3674+
ssl_openssl_cert_store = false;
36533675
#if NODE_FIPS_MODE
36543676
} else if (strcmp(arg, "--enable-fips") == 0) {
36553677
enable_fips_crypto = true;
Collapse file

‎src/node.h‎

Copy file name to clipboardExpand all lines: src/node.h
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,9 +179,12 @@ typedef intptr_t ssize_t;
179179
namespace node {
180180

181181
NODE_EXTERN extern bool no_deprecation;
182-
#if HAVE_OPENSSL && NODE_FIPS_MODE
182+
#if HAVE_OPENSSL
183+
NODE_EXTERN extern bool ssl_openssl_cert_store;
184+
# if NODE_FIPS_MODE
183185
NODE_EXTERN extern bool enable_fips_crypto;
184186
NODE_EXTERN extern bool force_fips_crypto;
187+
# endif
185188
#endif
186189

187190
NODE_EXTERN int Start(int argc, char *argv[]);
Collapse file

‎src/node_crypto.cc‎

Copy file name to clipboardExpand all lines: src/node_crypto.cc
+7-7Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -707,14 +707,14 @@ static X509_STORE* NewRootCertStore() {
707707
}
708708

709709
X509_STORE* store = X509_STORE_new();
710-
#if defined(NODE_OPENSSL_CERT_STORE)
711-
X509_STORE_set_default_paths(store);
712-
#else
713-
for (X509 *cert : root_certs_vector) {
714-
X509_up_ref(cert);
715-
X509_STORE_add_cert(store, cert);
710+
if (ssl_openssl_cert_store) {
711+
X509_STORE_set_default_paths(store);
712+
} else {
713+
for (X509 *cert : root_certs_vector) {
714+
X509_up_ref(cert);
715+
X509_STORE_add_cert(store, cert);
716+
}
716717
}
717-
#endif
718718

719719
return store;
720720
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.