Skip to content

Commit 7791118

Browse files
joyeecheungaduh95
authored andcommitted
doc: clarify --use-system-ca support status
Node.js only checks trust settings of additional certificates from the system store. It does not, however, support revocation/distrust of existing certificates. PR-URL: #60340 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 674befe commit 7791118

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

doc/api/cli.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3048,21 +3048,18 @@ On platforms other than Windows and macOS, this loads certificates from the dire
30483048
and file trusted by OpenSSL, similar to `--use-openssl-ca`, with the difference being
30493049
that it caches the certificates after first load.
30503050

3051-
On Windows and macOS, the certificate trust policy is planned to follow
3052-
[Chromium's policy for locally trusted certificates][]:
3051+
On Windows and macOS, the certificate trust policy is similar to
3052+
[Chromium's policy for locally trusted certificates][], but with some differences:
30533053

30543054
On macOS, the following settings are respected:
30553055

30563056
* Default and System Keychains
30573057
* Trust:
30583058
* Any certificate where the “When using this certificate” flag is set to “Always Trust” or
3059-
* Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust.”
3060-
* Distrust:
3061-
* Any certificate where the “When using this certificate” flag is set to “Never Trust” or
3062-
* Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Never Trust.”
3059+
* Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust”.
3060+
* The certificate must also be valid, with "X.509 Basic Policy" set to “Always Trust”.
30633061

3064-
On Windows, the following settings are respected (unlike Chromium's policy, distrust
3065-
and intermediate CA are not currently supported):
3062+
On Windows, the following settings are respected:
30663063

30673064
* Local Machine (accessed via `certlm.msc`)
30683065
* Trust:
@@ -3077,8 +3074,11 @@ and intermediate CA are not currently supported):
30773074
* Trusted Root Certification Authorities
30783075
* Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities
30793076

3080-
On Windows and macOS, Node.js would check that the user settings for the certificates
3081-
do not forbid them for TLS server authentication before using them.
3077+
On Windows and macOS, Node.js would check that the user settings for the trusted
3078+
certificates do not forbid them for TLS server authentication before using them.
3079+
3080+
Node.js currently does not support distrust/revocation of certificates
3081+
from another source based on system settings.
30823082

30833083
On other systems, Node.js loads certificates from the default certificate file
30843084
(typically `/etc/ssl/cert.pem`) and default certificate directory (typically

0 commit comments

Comments
 (0)