mirror of
https://github.com/nodejs/node.git
synced 2025-08-15 13:48:44 +02:00
a7909014f7
To accompany --use-system-ca, this adds a new API that allows querying various kinds of CA certificates. - If the first argument `type` is `"default"` or undefined, it returns the CA certificates that will be used by Node.js TLS clients by default, which includes the Mozilla CA if --use-bundled-ca is enabled or --use-openssl-ca is not enabled, and the system certificates if --use-system-ca is enabled, and the extra certificates if NODE_EXTRA_CA_CERTS is used. - If `type` is `"system"` this returns the system certificates, regardless of whether --use-system-ca is enabeld or not. - If `type` is `"bundled"` this is the same as `tls.rootCertificates` and returns the Mozilla CA certificates. - If `type` is `"extra"` this returns the certificates parsed from the path specified by NODE_EXTRA_CA_CERTS. Drive-by: remove the inaccurate description in `tls.rootCertificates` about including system certificates, since it in fact does not include them, and also it is contradicting the previous description about `tls.rootCertificates` always returning the Mozilla CA store and staying the same across platforms. PR-URL: https://github.com/nodejs/node/pull/57107 Reviewed-By: James M Snell <jasnell@gmail.com>
17 lines
599 B
JavaScript
17 lines
599 B
JavaScript
'use strict';
|
|
|
|
const tls = require('tls');
|
|
const assert = require('assert');
|
|
|
|
const defaultSet = new Set(tls.getCACertificates('default'));
|
|
const extraSet = new Set(tls.getCACertificates('extra'));
|
|
console.log(defaultSet.size, 'default certificates');
|
|
console.log(extraSet.size, 'extra certificates')
|
|
|
|
// Parent process is supposed to call this with
|
|
// NODE_EXTRA_CA_CERTS set to test/fixtures/keys/ca1-cert.pem.
|
|
assert.strictEqual(extraSet.size, 1);
|
|
|
|
// Check that default set is a super set of extra set.
|
|
assert.deepStrictEqual(defaultSet.intersection(extraSet),
|
|
extraSet);
|