crypto: add extra CA certs to all secure contexts #44529

ebickle · 2022-09-06T04:47:26Z

Fixes the NODE_EXTRA_CA_CERTS root certificates being missing in a SecureContext when the crl or pfx options are specified in a call to tls.createSecureContext(). This was done by loading the NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called.

As part of this change, specifying NODE_EXTRA_CA_CERTS no longer causes the bundled CA store to be immediately loaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. Although this change effectively reverts #20434, it does not reintroduce issue #20432 because the environment variable is read at startup; modifying it at runtime has no effect.

Notes for code reviewers:

NewRootStore now takes an Environment* as a parameter. This was done so that ProcessEmitWarning could be called when the extra certificates could not be loaded. As a bonus, the warning can now be programatically read via the process warning event.
The new intent of root_certs_vector is that it should contain all certificates added to root_cert_store, not just the ones loaded from node_root_certs.h.
The existing code contained an incorrect X509_up_ref call that resulted in the X509_STORE's reference count continually increasing. This issue has been resolved.

Fixes: #32010
Refs: #40524, #23354, #20434

nodejs-github-bot · 2022-09-06T04:47:30Z

Review requested:

@nodejs/crypto

src/crypto/crypto_context.cc

aduh95 · 2023-09-20T10:32:09Z

Ping @nodejs/crypto for reviews

alex1701c · 2023-12-07T16:51:10Z

Would this also work with electron? I ask regarding electron/electron#10257

ebickle · 2024-07-23T19:48:11Z

@nodejs/crypto I've resolved the conflicts in this PR - it's ready for review again

ccing @pimterry

pimterry

Some minor nitpicking about test details but nothing critical (up to you if/how you want to do those). The implementation itself looks great to me 👍

Would be nice to have a review from somebody else from @nodejs/crypto who is a bit more familiar with this if we can, since the core TLS trust store setup is quite sensitive code. Let's give it a few days for anybody else to chime in.

test/parallel/test-tls-env-extra-ca-with-ca.js

pimterry · 2024-07-24T09:46:46Z

test/parallel/test-tls-env-extra-ca-with-ca.js

+  // instead of replacing, so connection still succeeds.
+  copts.secureContext.context.addCACert(
+    fixtures.readKey('ca1-cert.pem')
+  );


It would be better if we did this without directly messing with the context like this, but I understand there's no usable API for additional CAs right now - this is really just a note that we should update this as part of adding that API in #27079

Agree completely. So long as we land the "additional CA" functionality shortly after and then replace this test, temporarily relying on the 'internal' context behavior makes sense to ensure we have proper coverage in the mean time.

test/parallel/test-tls-env-extra-ca-with-ca.js

nodejs-github-bot · 2024-07-24T12:11:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/60586/

nodejs-github-bot · 2024-07-26T09:05:06Z

CI: https://ci.nodejs.org/job/node-test-pull-request/60644/

pimterry

Test changes look good, thanks 👍

CI is failing because of a conflict with main (https://ci.nodejs.org/job/node-test-commit/72499/console) can you rebase?

Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called. When NODE_EXTRA_CA_CERTS is specified, the root certificates (both bundled and extra) will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. The original reason NODE_EXTRA_CA_CERTS were loaded at startup (issues nodejs#20432, nodejs#20434) was to prevent the environment variable from being changed at runtime. This change preserves the runtime consistency without actually having to load the certs at startup. Fixes: nodejs#32010 Refs: nodejs#40524 Refs: nodejs#23354

ebickle · 2024-07-26T17:38:35Z

@pimterry Rebased back onto upstream main. Can you give it another try?

nodejs-github-bot · 2024-07-29T14:55:24Z

CI: https://ci.nodejs.org/job/node-test-pull-request/60724/

Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called, rather than losing them when unrelated options are provided. When NODE_EXTRA_CA_CERTS is specified, the root certificates (both bundled and extra) will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. The original reason NODE_EXTRA_CA_CERTS were loaded at startup (issues #20432, #20434) was to prevent the environment variable from being changed at runtime. This change preserves the runtime consistency without actually having to load the certs at startup. Fixes: #32010 Refs: #40524 Refs: #23354 PR-URL: #44529 Reviewed-By: Tim Perry <[email protected]>

pimterry · 2024-07-30T12:21:13Z

Landed in 7485ad8

Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called, rather than losing them when unrelated options are provided. When NODE_EXTRA_CA_CERTS is specified, the root certificates (both bundled and extra) will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. The original reason NODE_EXTRA_CA_CERTS were loaded at startup (issues #20432, #20434) was to prevent the environment variable from being changed at runtime. This change preserves the runtime consistency without actually having to load the certs at startup. Fixes: #32010 Refs: #40524 Refs: #23354 PR-URL: #44529 Reviewed-By: Tim Perry <[email protected]>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Sep 6, 2022

ebickle force-pushed the fix/tls-missing-extra-certificates branch from 314bada to 3857c32 Compare September 6, 2022 04:51

bnoordhuis reviewed Sep 6, 2022

View reviewed changes

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

Trott force-pushed the main branch from 2d76238 to ca3ed36 Compare November 12, 2022 01:49

pimterry mentioned this pull request Jul 23, 2024

Documented way to add certificates to existing SecureContext #27079

Open

ebickle closed this Jul 23, 2024

ebickle deleted the fix/tls-missing-extra-certificates branch July 23, 2024 12:42

ebickle restored the fix/tls-missing-extra-certificates branch July 23, 2024 15:39

ebickle reopened this Jul 23, 2024

pimterry approved these changes Jul 24, 2024

View reviewed changes

pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 24, 2024

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 24, 2024

pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 26, 2024

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 26, 2024

pimterry approved these changes Jul 26, 2024

View reviewed changes

ebickle force-pushed the fix/tls-missing-extra-certificates branch from 53ae059 to 61b1f13 Compare July 26, 2024 15:07

pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2024

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2024

pimterry approved these changes Jul 30, 2024

View reviewed changes

pimterry closed this Jul 30, 2024

RafaelGSS mentioned this pull request Aug 19, 2024

v22.7.0 proposal #54452

Merged

targos added the dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. label Sep 21, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: add extra CA certs to all secure contexts #44529

crypto: add extra CA certs to all secure contexts #44529

ebickle commented Sep 6, 2022 •

edited

Loading

nodejs-github-bot commented Sep 6, 2022

This comment was marked as outdated.

This comment was marked as outdated.

aduh95 commented Sep 20, 2023

alex1701c commented Dec 7, 2023

ebickle commented Jul 23, 2024

pimterry left a comment

pimterry Jul 24, 2024

ebickle Jul 24, 2024

nodejs-github-bot commented Jul 24, 2024

nodejs-github-bot commented Jul 26, 2024

pimterry left a comment

ebickle commented Jul 26, 2024

nodejs-github-bot commented Jul 29, 2024

pimterry commented Jul 30, 2024

crypto: add extra CA certs to all secure contexts #44529

crypto: add extra CA certs to all secure contexts #44529

Conversation

ebickle commented Sep 6, 2022 • edited Loading

nodejs-github-bot commented Sep 6, 2022

This comment was marked as outdated.

This comment was marked as outdated.

aduh95 commented Sep 20, 2023

alex1701c commented Dec 7, 2023

ebickle commented Jul 23, 2024

pimterry left a comment

Choose a reason for hiding this comment

pimterry Jul 24, 2024

Choose a reason for hiding this comment

ebickle Jul 24, 2024

Choose a reason for hiding this comment

nodejs-github-bot commented Jul 24, 2024

nodejs-github-bot commented Jul 26, 2024

pimterry left a comment

Choose a reason for hiding this comment

ebickle commented Jul 26, 2024

nodejs-github-bot commented Jul 29, 2024

pimterry commented Jul 30, 2024

ebickle commented Sep 6, 2022 •

edited

Loading