feat: added support for reading certificates from macOS system store by timja · Pull Request #56599 · nodejs/node

timja · 2025-01-14T16:03:07Z

Builds on #44532 but for macOS

TODO:

~~Make it work~~, it works 🥳
~~Review that all CF resources are being appropriately released~~, I think its right now
~~Review whether and where tests are appropriate~~ - Added although disabled by default

I can take a look at the Windows one after, resolving the conflicts and addressing the review comments as well.

Happy to refactor heavily, I haven't used c++ before and I wrote it initially in objective c and ported it across.
This is heavily based upon chromium and some of OpenJDK along with a PR I have open with OpenJDK

Testing

I'm using https://github.com/timja/openjdk-intermediate-ca-reproducer as a reproducer:

docker compose up --build

Install the certificates, either by adding to keychain manually (see README) or using /usr/bin/security (see what the test is doing in this PR.

main.js

letresp=awaitfetch("https://localhost:8443");console.log(resp.status);// 200console.log(resp.headers.get("Content-Type"));// "text/html"console.log(awaitresp.text());// "Hello, World!"

/Users/$USER/projects/node/out/Release/node --use-system-ca main.js

I've also tested this through a ZScaler MiTM setup.

nodejs-github-bot · 2025-01-14T16:03:13Z

Review requested:

@nodejs/crypto
@nodejs/gyp

timja · 2025-01-15T09:04:36Z

Would it be possible for someone to re-open the feature request please? #39657. It was closed due to being stale / no progress on it.

timja · 2025-01-20T17:00:11Z

Thanks for the reviews all I'll continue actioning tomorrow.

joyeecheung

Some last comments, I think this is getting close. Thanks for following along!

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <raisinten@gmail.com> PR-URL: #57432 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jan 14, 2025

timja mentioned this pull request Jan 14, 2025
Allow Node to use certificates from the macOS Keychain when making HTTPS requests #39657
Closed

timja commented Jan 14, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

timja force-pushed the macos-system-ca-support branch from 8fd32ce to f3c212cCompare January 14, 2025 16:32

addaleax reviewed Jan 14, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated

anonrig requested a review from jasnell January 14, 2025 17:29

joyeecheung reviewed Jan 15, 2025
View reviewed changes

Comment threaddoc/api/tls.md Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated

joyeecheung reviewed Jan 15, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

timja requested review from addaleax and joyeecheung January 15, 2025 17:03

timja marked this pull request as ready for review January 16, 2025 15:22

joyeecheung reviewed Jan 20, 2025
View reviewed changes

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadtest/parallel/test-native-certs-macos.mjs Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadtest/parallel/test-native-certs-macos.mjs Outdated

jasnell reviewed Jan 20, 2025
View reviewed changes

Comment threadtest/parallel/test-native-certs-macos.mjs Outdated

joyeecheung reviewed Jan 20, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated

timja requested review from jasnell and joyeecheung January 22, 2025 10:44

joyeecheung reviewed Jan 24, 2025
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated

RafaelGSS mentioned this pull request Apr 11, 2025
2025-04-23, Version 22.15.0 'Jod' (LTS), @UlisesGascon prepared by @RafaelGSS #57840
Merged

This was referenced Apr 23, 2025
Self signed SSL Certificate support for DevContainers microsoft/vscode-remote-release#6092
Open
Read root certificates from OS cert stores devcontainers/cli#412
Open

This was referenced May 15, 2025
Create an environment variable as an alternative to the --use-system-ca CLI flag nodejs/node-gyp#3162
Closed
Create an environment variable as an alternative to the --use-system-ca CLI flag #58346
Closed

joyeecheung mentioned this pull request Jul 8, 2025
Tracking issue: custom CA certificate support #58990
Open
16 tasks

zoltan-magyar mentioned this pull request Jan 28, 2026
--use-system-ca does not work with macOS Keychain #61561
Closed

AlCalzone mentioned this pull request May 13, 2026
Consider further Node.js version bumps zwave-js/zwave-js#8820
Closed

Uh oh!

Uh oh!

Conversation

timja commented Jan 14, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Uh oh!

nodejs-github-bot commented Jan 14, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

timja commented Jan 15, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

timja commented Jan 20, 2025

Uh oh!

joyeecheung left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

timja commented Jan 14, 2025•
edited
Loading

timja commented Jan 15, 2025•
edited
Loading