@@ -3048,21 +3048,18 @@ On platforms other than Windows and macOS, this loads certificates from the dire
30483048and file trusted by OpenSSL, similar to ` --use-openssl-ca ` , with the difference being
30493049that it caches the certificates after first load.
30503050
3051- On Windows and macOS, the certificate trust policy is planned to follow
3052- [ Chromium's policy for locally trusted certificates] [ ] :
3051+ On Windows and macOS, the certificate trust policy is similar to
3052+ [ Chromium's policy for locally trusted certificates] [ ] , but with some differences :
30533053
30543054On macOS, the following settings are respected:
30553055
30563056* Default and System Keychains
30573057 * Trust:
30583058 * Any certificate where the “When using this certificate” flag is set to “Always Trust” or
3059- * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust.”
3060- * Distrust:
3061- * Any certificate where the “When using this certificate” flag is set to “Never Trust” or
3062- * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Never Trust.”
3059+ * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust”.
3060+ * The certificate must also be valid, with "X.509 Basic Policy" set to “Always Trust”.
30633061
3064- On Windows, the following settings are respected (unlike Chromium's policy, distrust
3065- and intermediate CA are not currently supported):
3062+ On Windows, the following settings are respected:
30663063
30673064* Local Machine (accessed via ` certlm.msc ` )
30683065 * Trust:
@@ -3077,8 +3074,11 @@ and intermediate CA are not currently supported):
30773074 * Trusted Root Certification Authorities
30783075 * Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities
30793076
3080- On Windows and macOS, Node.js would check that the user settings for the certificates
3081- do not forbid them for TLS server authentication before using them.
3077+ On Windows and macOS, Node.js would check that the user settings for the trusted
3078+ certificates do not forbid them for TLS server authentication before using them.
3079+
3080+ Node.js currently does not support distrust/revocation of certificates
3081+ from another source based on system settings.
30823082
30833083On other systems, Node.js loads certificates from the default certificate file
30843084(typically ` /etc/ssl/cert.pem ` ) and default certificate directory (typically
0 commit comments