If you have to deal with HTTPS within a corporate environment or otherwise have to deal with locally installed CA certificates somehow, give —use-system-ca a try! It’s currently only added in Windows and macOS, support for other systems is WIP though —use-openssl-ca already works for other systems - ThreadSky

joyeecheung.bsky.social • 132 days ago

If you have to deal with HTTPS within a corporate environment or otherwise have to deal with locally installed CA certificates somehow, give —use-system-ca a try! It’s currently only added in Windows and macOS, support for other systems is WIP though —use-openssl-ca already works for other systems

Reposted from Michael Zasso

Just released Node.js v23.8.0.
It includes an initial implementation of URLPattern, an new flag to load system certificates, zstd, and more!
nodejs.org/en/blog/rele...

Comments

joyeecheung.bsky.social•132 days ago

While support for loading the system CA certificates has been implemented in various tools other than Node.js, it is somewhat interesting that across different PL, tools are usually doing their own thing..Node.js' implementation roughly follows Chromium's policy on Windows and macOS for now

joyeecheung.bsky.social•132 days ago

Difference between --use-openssl-ca and --use-system-ca:

- On macOS and Windows, --use-system-ca uses the system APIs to load trusted certificates and verify usage for TLS
- --use-openssl-ca uses OpenSSL default paths, which may not work on macOS and Windows, though works with most Linux distros

joyeecheung.bsky.social•132 days ago

The WIP of --use-system-ca on Linux etc. will likely be similar to --use-openssl-ca, though it will cache the certificates on first load, similar to how it behaves on other systems. So it's basically --use-openssl-ca but cached and less OpenSSL-specific (works more natively on Windows and macOS)

joyeecheung.bsky.social•131 days ago

Support for other systems (caching certificates from OpenSSL default certificate file and directory, which should work on most other UNIX-like system because other CLI tools typically rely on this): https://github.com/nodejs/node/pull/57009

rajsite.com•119 days ago

Awesome! Are there plans for an env var like DENO_TLS_CA_STORE or some way to make --use-system-ca the default?
https://deno.com/blog/v1.13#use-system-certificate-store-for-tls

joyeecheung.bsky.social•119 days ago

It can be enabled from the environment variables via NODE_OPTIONS, like many other command line options. I think to make it the default some performance impact may need to be investigated, or at least documented (it will slow down the first TLS connection made, though I am not exactly sure how much)

rajsite.com•119 days ago

Wasn't familiar with NODE_OPTIONS, I'll have to try it out! Thanks for the reply!

shinebayar.dev•131 days ago

Is this potentially going to replace NODE_EXTRA_CA_CERTS env usage?

joyeecheung.bsky.social•131 days ago

If the CA certs you want to drop into Node.js are already installed as trusted certificates in the system, then there is no need to use NODE_EXTRA_CA_CERTS if you have --use-system-ca in the version of Node.js you are using, yes.

shinebayar.dev•127 days ago

Very nice. Will it be backported to 22?

joyeecheung.bsky.social•127 days ago

Likely yes, there isn't anything stopping it from being backported :)

Comments

Posting Rules

Reply