Make --use-system-ca per-env rather than per-process by Aditi-1400 · Pull Request #60678 · nodejs/node

Aditi-1400 · 2025-11-11T10:17:27Z

Makes the --use-system-ca option a per-environment option rather than a per-process option so that workers can enable/disable them individually

nodejs-github-bot · 2025-11-11T10:17:33Z

Review requested:

@nodejs/config
@nodejs/crypto
@nodejs/startup

joyeecheung · 2025-11-11T11:05:43Z

Hmm, I think this may need more work than just updating the options - the implication of being per-env is that each worker would then be able to toggle this independently. Say when the main thread does not enable it but a worker does, then the worker will have the system CA certs in their default store but the parent doesn't. Can you add a test for this, and the other way around (parent enables it, worker disables it)? My impression is that the default store initialisation code is not yet ready for this and it's still shared across the process (so if a worker enables it, suddenly the parent get it too, which would be unexpected).

codecov · 2025-11-11T11:25:22Z

Codecov Report

❌ Patch coverage is 78.94737% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.77%. Comparing base (04946a7) to head (e450cb1).
⚠️ Report is 151 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_context.cc	77.27%	9 Missing and 11 partials ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #60678 +/- ##
==========================================
+ Coverage 89.73% 89.77% +0.03% 
==========================================
Files 675 674 -1 Lines 204648 205728 +1080 Branches 39330 39433 +103 ==========================================
+ Hits 183651 184697 +1046 + Misses 13282 13274 -8 - Partials 7715 7757 +42

Files with missing lines	Coverage Δ
src/crypto/crypto_common.cc	`77.47% <100.00%> (ø)`
src/crypto/crypto_context.h	`100.00% <ø> (ø)`
src/node.cc	`76.39% <ø> (+0.10%)`	⬆️
src/node_options.cc	`76.47% <100.00%> (+0.19%)`	⬆️
src/node_options.h	`97.93% <100.00%> (+0.04%)`	⬆️
src/crypto/crypto_context.cc	`71.42% <77.27%> (+0.59%)`	⬆️

... and 153 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

joyeecheung

Can you add some tests to test/parallel that checks this affects tls.getCACertificates('default') in a worker if tls.getCACertificates('system') returns non-empty in a parent? (if there are no system CAs in the testing machine, then the test can be skipped - that way it can run even without the mock certificates installed)

joyeecheung

LGTM, thanks

nodejs-github-bot · 2026-02-09T14:35:58Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71268/

nodejs-github-bot · 2026-02-11T21:52:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71314/

nodejs-github-bot · 2026-02-11T23:06:56Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71316/

nodejs-github-bot · 2026-03-03T12:48:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71541/

nodejs-github-bot · 2026-03-06T14:41:41Z

Landed in 83f5cc7

PR-URL: #60678 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | patch | `25.8.0` → `25.8.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.8.1`](https://github.com/nodejs/node/releases/tag/v25.8.1): 2026-03-11, Version 25.8.1 (Current), @aduh95 [Compare Source](nodejs/node@v25.8.0...v25.8.1) ##### Notable Changes - \[[`ea87eea71a`](nodejs/node@ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#62083](nodejs/node#62083) ##### Commits - \[[`bab750d1b3`](nodejs/node@bab750d1b3)] - **build**: do not depend on V8 deps on `--without-bundled-v8` builds (Antoine du Hamel) [#62033](nodejs/node#62033) - \[[`b26d1c7fcb`](nodejs/node@b26d1c7fcb)] - **crypto**: make --use-system-ca per-env rather than per-process (Aditi) [#60678](nodejs/node#60678) - \[[`e362635abf`](nodejs/node@e362635abf)] - **crypto**: add missing AES dictionaries (Filip Skokan) [#62099](nodejs/node#62099) - \[[`6f975db8af`](nodejs/node@6f975db8af)] - **crypto**: fix importKey required argument count check (Filip Skokan) [#62099](nodejs/node#62099) - \[[`3beaf9c5fc`](nodejs/node@3beaf9c5fc)] - **deps**: update amaro to 1.1.8 (Node.js GitHub Bot) [#62151](nodejs/node#62151) - \[[`53afb0edd8`](nodejs/node@53afb0edd8)] - **deps**: update sqlite to 3.52.0 (Node.js GitHub Bot) [#62150](nodejs/node#62150) - \[[`a13ed052a1`](nodejs/node@a13ed052a1)] - **deps**: update merve to 1.2.0 (Node.js GitHub Bot) [#62149](nodejs/node#62149) - \[[`2c850577b7`](nodejs/node@2c850577b7)] - **deps**: patch resb crate (Richard Lau) [#62138](nodejs/node#62138) - \[[`37862a6728`](nodejs/node@37862a6728)] - **deps**: V8: cherry-pick [`aa0b288`](nodejs/node@aa0b288f87cc) (Richard Lau) [#62136](nodejs/node#62136) - \[[`09191ad8b4`](nodejs/node@09191ad8b4)] - **deps**: update ada to 3.4.3 (Node.js GitHub Bot) [#62049](nodejs/node#62049) - \[[`8d63a178fd`](nodejs/node@8d63a178fd)] - **doc**: copyedit `addons.md` (Antoine du Hamel) [#62071](nodejs/node#62071) - \[[`83719ffb64`](nodejs/node@83719ffb64)] - **doc**: correct `util.convertProcessSignalToExitCode` validation behavior (René) [#62134](nodejs/node#62134) - \[[`eeee7c7fb1`](nodejs/node@eeee7c7fb1)] - **doc**: add efekrskl as triager (Efe) [#61876](nodejs/node#61876) - \[[`db150b2e69`](nodejs/node@db150b2e69)] - **doc**: fix markdown for `expectFailure` values (Jacob Smith) [#62100](nodejs/node#62100) - \[[`d55a441e60`](nodejs/node@d55a441e60)] - **doc**: add title to index (Aviv Keller) [#62046](nodejs/node#62046) - \[[`cc46204b48`](nodejs/node@cc46204b48)] - **doc**: include url.resolve() in DEP0169 application deprecation (Mike McCready) [#62002](nodejs/node#62002) - \[[`1d91a7261e`](nodejs/node@1d91a7261e)] - **doc,module**: add missing doc for syncHooks.deregister() (Joyee Cheung) [#61959](nodejs/node#61959) - \[[`5198573bee`](nodejs/node@5198573bee)] - **http**: fix use-after-free when freeParser is called during llhttp\_execute (Gerhard Stöbich) [#62095](nodejs/node#62095) - \[[`f8793f80df`](nodejs/node@f8793f80df)] - **lib**: fix source map url parse in dynamic imports (Chengzhong Wu) [#61990](nodejs/node#61990) - \[[`5439d0e0cf`](nodejs/node@5439d0e0cf)] - **meta**: bump actions/download-artifact from 7.0.0 to 8.0.0 (dependabot\[bot]) [#62063](nodejs/node#62063) - \[[`27fd21943a`](nodejs/node@27fd21943a)] - **meta**: bump actions/upload-artifact from 6.0.0 to 7.0.0 (dependabot\[bot]) [#62062](nodejs/node#62062) - \[[`5b266f3295`](nodejs/node@5b266f3295)] - **meta**: bump step-security/harden-runner from 2.14.2 to 2.15.0 (dependabot\[bot]) [#62064](nodejs/node#62064) - \[[`ea87eea71a`](nodejs/node@ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#62083](nodejs/node#62083) - \[[`851228cd60`](nodejs/node@851228cd60)] - **sqlite**: handle stmt invalidation (Guilherme Araújo) [#61877](nodejs/node#61877) - \[[`19efe60548`](nodejs/node@19efe60548)] - **src**: expose async context frame debugging helper to JS (Anna Henningsen) [#62103](nodejs/node#62103) - \[[`0257e8072f`](nodejs/node@0257e8072f)] - **src**: make AsyncWrap subclass internal field counts explicit (Anna Henningsen) [#62103](nodejs/node#62103) - \[[`975dafbe3b`](nodejs/node@975dafbe3b)] - **src**: release context frame in AsyncWrap::EmitDestroy (Gerhard Stöbich) [#61995](nodejs/node#61995) - \[[`f2c08c7888`](nodejs/node@f2c08c7888)] - **src**: use validate\_ascii\_with\_errors instead of validate\_ascii (Сковорода Никита Андреевич) [#61122](nodejs/node#61122) - \[[`0278461d83`](nodejs/node@0278461d83)] - **stream**: optimize webstreams pipeTo (Mattias Buelens) [#62079](nodejs/node#62079) - \[[`4d62e95bfa`](nodejs/node@4d62e95bfa)] - **stream**: fix brotli error handling in web compression streams (Filip Skokan) [#62107](nodejs/node#62107) - \[[`4bdcaf2865`](nodejs/node@4bdcaf2865)] - **stream**: improve Web Compression spec compliance (Filip Skokan) [#62107](nodejs/node#62107) - \[[`a5b1be2045`](nodejs/node@a5b1be2045)] - **stream**: fix UTF-8 character corruption in fast-utf8-stream (Matteo Collina) [#61745](nodejs/node#61745) - \[[`5632446c4e`](nodejs/node@5632446c4e)] - **stream**: fix TransformStream race on cancel with pending write (Marco) [#62040](nodejs/node#62040) - \[[`f90fa9cd1a`](nodejs/node@f90fa9cd1a)] - **stream**: accept ArrayBuffer in CompressionStream and DecompressionStream (조수민) [#61913](nodejs/node#61913) - \[[`00319eaa3a`](nodejs/node@00319eaa3a)] - **test**: update WPT for url to [`c928b19`](nodejs/node@c928b19ab0) (Node.js GitHub Bot) [#62148](nodejs/node#62148) - \[[`456abc7d20`](nodejs/node@456abc7d20)] - **test**: update WPT for WebCryptoAPI to [`c9e9558`](nodejs/node@c9e955840a) (Node.js GitHub Bot) [#62147](nodejs/node#62147) - \[[`82770cb7d3`](nodejs/node@82770cb7d3)] - **test**: improve WPT report runner (Filip Skokan) [#62107](nodejs/node#62107) - \[[`cfc847d233`](nodejs/node@cfc847d233)] - **test**: update WPT compression to [`ae05f5c`](nodejs/node@ae05f5cb53) (Filip Skokan) [#62107](nodejs/node#62107) - \[[`80f78f2737`](nodejs/node@80f78f2737)] - **test**: update WPT for WebCryptoAPI to [`42e4732`](nodejs/node@42e47329fd) (Node.js GitHub Bot) [#62048](nodejs/node#62048) - \[[`8048e0508c`](nodejs/node@8048e0508c)] - **test**: fix skipping behavior for `test-runner-run-files-undefined` (Antoine du Hamel) [#62026](nodejs/node#62026) - \[[`699a6214c6`](nodejs/node@699a6214c6)] - **tools**: revert timezone update GHA workflow to ubuntu-latest (Richard Lau) [#62140](nodejs/node#62140) - \[[`1a453b550c`](nodejs/node@1a453b550c)] - **tools**: improve error handling in test426 update script (Rich Trott) [#62121](nodejs/node#62121) - \[[`710dde5ee2`](nodejs/node@710dde5ee2)] - **tools**: fix `--node-builtin-modules-path` value in `shell.nix` (Antoine du Hamel) [#62102](nodejs/node#62102) - \[[`dcb1cbb21f`](nodejs/node@dcb1cbb21f)] - **tools**: bump the eslint group across 1 directory with 2 updates (dependabot\[bot]) [#62092](nodejs/node#62092) - \[[`7d0b758583`](nodejs/node@7d0b758583)] - **tools**: fix daily wpt workflow nighly release version lookup (Filip Skokan) [#62076](nodejs/node#62076) - \[[`3e8c816f2e`](nodejs/node@3e8c816f2e)] - **tools**: fix example in release proposal linter (Richard Lau) [#62074](nodejs/node#62074) - \[[`772d3d270d`](nodejs/node@772d3d270d)] - **tools**: bump minimatch from 3.1.3 to 3.1.5 in /tools/clang-format (dependabot\[bot]) [#62013](nodejs/node#62013) - \[[`92f3b42672`](nodejs/node@92f3b42672)] - **tools**: bump eslint to v10, babel to v8.0.0-rc.2 (Huáng Jùnliàng) [#61905](nodejs/node#61905) - \[[`deead95ec5`](nodejs/node@deead95ec5)] - **url**: suppress warnings from url.format/url.resolve inside node\_modules (René) [#62005](nodejs/node#62005) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

aduh95 · 2026-05-07T15:03:04Z

This doesn't land cleanly, and would require a manual backport PR if we want it on Node.js 24

PR-URL: nodejs#60678 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Aditi-1400 requested a review from joyeecheung November 11, 2025 10:17

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Nov 11, 2025

Aditi-1400 force-pushed the ca-per-env branch 2 times, most recently from d87558c to 23473b9Compare November 11, 2025 10:28

Aditi-1400 force-pushed the ca-per-env branch 2 times, most recently from f22457c to 780c272Compare December 2, 2025 14:16

Aditi-1400 force-pushed the ca-per-env branch 4 times, most recently from 38913f9 to d9fb49dCompare December 12, 2025 18:05

joyeecheung reviewed Jan 6, 2026
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc

Aditi-1400 force-pushed the ca-per-env branch 2 times, most recently from 77856be to d8281c4Compare January 15, 2026 13:56

joyeecheung mentioned this pull request Jan 15, 2026
Tracking issue: custom CA certificate support #58990
Open
16 tasks

joyeecheung reviewed Jan 23, 2026
View reviewed changes

Comment threadtest/parallel/test-tls-get-ca-certificates-worker-use-system-ca.js Outdated
Comment threadtest/parallel/test-tls-get-ca-certificates-worker-use-system-ca.js Outdated
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc

Aditi-1400 force-pushed the ca-per-env branch from d8281c4 to 5d7dc6bCompare January 29, 2026 07:11

joyeecheung reviewed Jan 30, 2026
View reviewed changes

Comment threadsrc/crypto/crypto_context.cc
Comment threadsrc/crypto/crypto_context.cc Outdated
Comment threadsrc/crypto/crypto_context.cc
Comment threadsrc/node_options.cc

Aditi-1400 force-pushed the ca-per-env branch 2 times, most recently from 00f4b51 to aa9f038Compare February 2, 2026 10:47

joyeecheung reviewed Feb 2, 2026
View reviewed changes

Comment threadsrc/quic/tlscontext.cc Outdated
Comment threadsrc/crypto/crypto_context.cc

Aditi-1400 force-pushed the ca-per-env branch from aa9f038 to 0a77533Compare February 9, 2026 10:31

joyeecheung approved these changes Feb 9, 2026
View reviewed changes

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 9, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 9, 2026

joyeecheung approved these changes Feb 11, 2026
View reviewed changes

joyeecheung added request-ci Add this label to start a Jenkins CI on a PR. and removed request-ci-failed An error occurred while starting CI via request-ci label, and manual interventon is needed. labels Feb 11, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 11, 2026

Aditi-1400 added 2 commits February 25, 2026 10:05

crypto: make --use-system-ca per-env rather than per-process
33ea933

fixup! crypto: make --use-system-ca per-env rather than per-process
e450cb1

Aditi-1400 force-pushed the ca-per-env branch from 03a0105 to e450cb1Compare February 25, 2026 05:13

Aditi-1400 requested a review from joyeecheung February 26, 2026 06:10

joyeecheung approved these changes Mar 3, 2026
View reviewed changes

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Mar 3, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Mar 3, 2026

Aditi-1400 added commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 6, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 6, 2026

nodejs-github-bot merged commit 83f5cc7 into nodejs:mainMar 6, 2026
70 checks passed

aduh95 pushed a commit that referenced this pull request Mar 10, 2026
crypto: make --use-system-ca per-env rather than per-process
b26d1c7
PR-URL: #60678 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

github-actionsBot mentioned this pull request Mar 10, 2026
2026-03-11, Version 25.8.1 (Current) #62184
Merged

aduh95 added the backport-requested-v24.x PRs awaiting manual backport to the v24.x-staging branch. label May 7, 2026

aduh95 mentioned this pull request May 7, 2026
src: do not enable wasm trap handler if there's not enough vmem #62132
Closed

aduh95 mentioned this pull request Jul 22, 2026
[v24.x backport] node:stream/iter and QUIC backports #64675
Open

ghappforreleasepleaseBot mentioned this pull request Jul 27, 2026
chore(mise): upgrade local tools jylenhof/mise-update-tool#18
Closed

aduh95 pushed a commit to aduh95/node that referenced this pull request Jul 30, 2026
crypto: make --use-system-ca per-env rather than per-process
b98ac88
PR-URL: nodejs#60678 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Uh oh!

Uh oh!

Conversation

Aditi-1400 commented Nov 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 11, 2025

Uh oh!

joyeecheung commented Nov 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecovBot commented Nov 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

joyeecheung left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joyeecheung left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Feb 9, 2026

Uh oh!

nodejs-github-bot commented Feb 11, 2026

Uh oh!

nodejs-github-bot commented Feb 11, 2026

Uh oh!

nodejs-github-bot commented Mar 3, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Mar 6, 2026

Uh oh!

aduh95 commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Aditi-1400 commented Nov 11, 2025•
edited
Loading

joyeecheung commented Nov 11, 2025•
edited
Loading

codecovBot commented Nov 11, 2025•
edited
Loading

joyeecheung left a comment •
edited
Loading