crypto: fix CA trust block parsing - #64753

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Archkon:cert
Aug 5, 2026
Merged

crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Archkon:cert

Conversation

@Archkon

@ArchkonArchkon commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Fixes: #64752

@nodejs-github-bot

nodejs-github-bot commented Jul 26, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto

@Archkon
Archkon marked this pull request as draft July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Jul 26, 2026
@ArchkonArchkon changed the title stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov

codecovBot commented Jul 26, 2026•
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.

Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12

see 32 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ArchkonArchkon changed the title crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon marked this pull request as ready for review July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry approved these changes Jul 29, 2026
View reviewed changes

@pimterrypimterry left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@pimterrypimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026
@nodejs-github-bot

nodejs-github-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75286/

@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334 requested changes Aug 3, 2026
View reviewed changes

@Renegade334Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).

@Renegade334

Renegade334 commented Aug 3, 2026

Copy link
Copy Markdown
Member

eg. 6c96168

@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others added 2 commits August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334 approved these changes Aug 3, 2026
View reviewed changes

@Renegade334Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.

@Renegade334Renegade334 added commit-queue-squash PRs the Commit Queue should land as one squashed commit. lts-watch-v22.x PRs that may need to be released in v22.x author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Aug 3, 2026
@Renegade334Renegade334 added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 3, 2026
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 3, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75437/

@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller added the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 5, 2026
@nodejs-github-botnodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 579fb17 into nodejs:mainAug 5, 2026
90 of 92 checks passed
@nodejs-github-bot

nodejs-github-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Landed in 579fb17

@Renegade334Renegade334 mentioned this pull request Aug 5, 2026
Open
@Archkon
Archkon deleted the cert branch August 5, 2026 03:53
aduh95 pushed a commit that referenced this pull request Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit that referenced this pull request Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
This was referenced Aug 20, 2026
Closed
Open
juanarbol pushed a commit that referenced this pull request Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot mentioned this pull request Aug 25, 2026
Merged
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees

No one assigned

Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics

6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
crypto: fix CA trust block parsing  - #64753
Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Aug 5, 2026
Merged
crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom 
Archkon:cert
Conversation
@Archkon
@ArchkonArchkon
commented
Jul 26, 2026

Copy link


Copy Markdown

Contributor
Fixes: #64752
@nodejs-github-bot
nodejs-github-bot
commented
Jul 26, 2026

Copy link


Copy Markdown

Collaborator
Review requested:
  •  @nodejs/crypto
@Archkon
Archkon
marked this pull request as draft
July 26, 2026 05:51
@nodejs-github-botnodejs-github-bot
added

c++
Issues and PRs that require attention from people who are familiar with C++.
lib / src
Issues and PRs involving general changes in the lib/ or src/ directories.
needs-ci
PRs that need a full CI run.
labels
Jul 26, 2026
@ArchkonArchkon
changed the title
stagecrypto: honor NSS distrust-after datesJul 26, 2026
@Archkon

This comment was marked as spam.

Sign in to view
@codecov
codecovBot
commented
Jul 26, 2026•

edited

Loading

Copy link


Copy Markdown

Codecov Report
✅ All modified and coverable lines are covered by tests.

✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.
Additional details and impacted files
@@ Coverage Diff @@## main #64753 +/- ##
==========================================
- Coverage 90.28% 90.25% -0.03% 
==========================================
Files 762 762 Lines 247520 247524 +4 Branches 46692 46688 -4 ==========================================
- Hits 223468 223409 -59 - Misses 15483 15534 +51 - Partials 8569 8581 +12 
see 32 files with indirect coverage changes
 🚀 New features to boost your workflow: 
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@ArchkonArchkon
changed the title
crypto: honor NSS distrust-after datescrypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon
marked this pull request as ready for review
July 26, 2026 10:21
@Archkon

This comment was marked as spam.

Sign in to view
pimterry
pimterry
approved these changes
Jul 29, 2026
View reviewed changes
@pimterrypimterry
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@pimterrypimterry
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Jul 29, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Jul 29, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75286/
@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
Renegade334
Renegade334
requested changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).
@Renegade334
Renegade334
commented
Aug 3, 2026

Copy link


Copy Markdown

Member
eg. 6c96168
@Archkon

This comment was marked as spam.

Sign in to view
Archkonand others
added 2 commits
August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon@Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.
Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
Renegade334
Renegade334
approved these changes
Aug 3, 2026
View reviewed changes
@Renegade334Renegade334
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍
Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.
@Renegade334Renegade334
added

commit-queue-squash
PRs the Commit Queue should land as one squashed commit.
lts-watch-v22.x
PRs that may need to be released in v22.x
author ready
PRs with CI started, the required approvals, and no outstanding review comments.
labels
Aug 3, 2026
@Renegade334Renegade334
added
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@github-actionsgithub-actionsBot
removed
the 
request-ci
Add this label to start a Jenkins CI on a PR.
label
Aug 3, 2026
@nodejs-github-bot
nodejs-github-bot
commented
Aug 3, 2026

Copy link


Copy Markdown

Collaborator
CI: https://ci.nodejs.org/job/node-test-pull-request/75437/
@Archkon

This comment was marked as spam.

Sign in to view
@avivkelleravivkeller
added
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-botnodejs-github-bot
removed
the 
commit-queue
PRs queued for automated landing through the Commit Queue.
label
Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot
merged commit 579fb17
into
nodejs:mainAug 5, 2026

90 of 92 checks passed

@nodejs-github-bot
nodejs-github-bot
commented
Aug 5, 2026

Copy link


Copy Markdown

Collaborator
Landed in 579fb17
@Renegade334Renegade334
mentioned this pull request
Aug 5, 2026
 Open

@Archkon
Archkon
deleted the

cert

branch
August 5, 2026 03:53
aduh95 pushed a commit
that referenced
this pull request
Aug 13, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
a816f87
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
juanarbol pushed a commit
that referenced
this pull request
Aug 20, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
086b893
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This was referenced Aug 20, 2026
 Closed

 Open

juanarbol pushed a commit
that referenced
this pull request
Aug 21, 2026
@Archkon@juanarbol
tools: sync mk-ca-bundle.pl with curl
6f6cd37
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
aduh95 pushed a commit
that referenced
this pull request
Aug 25, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
b6fa9c1
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@github-actionsgithub-actionsBot
mentioned this pull request
Aug 25, 2026
 Merged

aduh95 pushed a commit
that referenced
this pull request
Aug 27, 2026
@Archkon@aduh95
tools: sync mk-ca-bundle.pl with curl
ceb0e99
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.
Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jasnelljasnelljasnell approved these changes
@pimterrypimterrypimterry approved these changes
@Renegade334Renegade334Renegade334 approved these changes

Assignees


No one assigned


Labels

author readyPRs with CI started, the required approvals, and no outstanding review comments.c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashPRs the Commit Queue should land as one squashed commit.lib / srcIssues and PRs involving general changes in the lib/ or src/ directories.lts-watch-v22.xPRs that may need to be released in v22.xneeds-ciPRs that need a full CI run.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics


6 participants

@Archkon@nodejs-github-bot@Renegade334@jasnell@pimterry@avivkeller