NODE_EXTRA_CA_CERTS cannot be set in code or relative #20432

sheerun · 2018-04-30T16:41:57Z

Version:
v9.11.1
Platform:
Darwin sheerun.dev 17.4.0 Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64 x86_64 i386 MacBookPro12,1 Darwin

When I start my server with

NODE_EXTRA_CA_CERTS=/Users/sheerun/Source/Ada/search/.certs/ca.crt bin/start

and in code make request to http server that serves with given certificate, all is good

But when I set it at the beginning of bin/start as so:

process.env.NODE_EXTRA_CA_CERTS = "/Users/sheerun/Source/Ada/search/.certs/ca.crt"

then node complains that there's "self signed certificate in certificate chain".

Particularly NODE_EXTRA_CA_CERTS doesn't work when I use dotenv package and set NODE_EXTRA_CA_CERTS in .env file.

Also, it seems NODE_EXTRA_CA_CERTS doesn't allow relative path, just absolute.

I think both of these issues should be addressed or at least documented with reasons why.

The text was updated successfully, but these errors were encountered:

bnoordhuis · 2018-04-30T18:51:22Z

Pull request welcome.

process.env.NODE_EXTRA_CA_CERTS

Not reliable because the extra certificates are loaded only once.

it seems NODE_EXTRA_CA_CERTS doesn't allow relative path, just absolute.

Relative paths should work.

sheerun · 2018-04-30T19:50:04Z

Not reliable because the extra certificates are loaded only once.

It would be nice if they were loaded only once but lazily, not before any code is executed in node. This way packages like dotenv would work because the recommendation is to run them at the very beginning. Possibly it could also speedup startup of node a bit.

sheerun · 2018-04-30T19:55:56Z

Also in #20434 you say that it is loaded lazily but it doesn't seem so unless node makes http requests I don't know about before first line of code is executed. Probably it is instantiated when some not yet started http server is instantiated, but I think it would be better to load certificates when it's actually needed (server starts, http request, tls function is executed).

Ideally you'd expose a function for reloading these..

Also my use case: setting up development environment with https self-signed certificate so Facebook integrations are working properly locally.

sheerun · 2018-04-30T19:58:20Z

Or maybe a function .addExtraCaCert() plus .freezeCaCerts() for security, just throwing ideas.

bnoordhuis · 2018-04-30T19:58:58Z

You should chime in on #20434 but keep in mind that NODE_EXTRA_CA_CERTS is to let system administrators add extra certificates without touching code. It's explicitly not Yet Another API for adding certificates programmatically.

bnoordhuis · 2018-04-30T20:00:31Z

Or maybe a function .addExtraCaCert() plus .freezeCaCerts() for security, just throwing ideas.

That might be acceptable. Can you file a new issue?

`NODE_EXTRA_CA_CERTS` is not intended to be used to set the paths of extra certificates and this approach to setting is not reliable. This commit makes node load extra certificates at startup instead of first use. Fixes: nodejs#20434 Refs: nodejs#20432

This commit makes node load extra certificates at startup instead of first use. PR-URL: nodejs#23354 Fixes: nodejs#20434 Refs: nodejs#20432 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

cinderblock · 2018-11-26T04:21:13Z

This seems to be possible. However I have not found any documentation of this.

One other mention of this method: #4464 (comment)

Example:

const tls = require('tls');
const secureContext = tls.createSecureContext();
// https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt
secureContext.context.addCACert(`-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----`);

const sock = tls.connect(443, 'host', {secureContext});

sam-github · 2018-11-26T17:11:53Z

Sorry, @cinderblock I don't understand your comment, or how it relates to NODE_EXTRA_CA_CERTS. Could you repost this question in http://github.com/nodejs/help, or as an independent issue if your believe there is a bug?

cinderblock · 2018-11-26T21:13:04Z

@sam-github You are correct that the titular question asks specifically about the NODE_EXTRA_CA_CERTS environment variable and setting that programmatically during runtime.

I however suspect the main thing in question is to set extra ca certificates in code/during runtime that don't override the built-in CA certificates. The method I've suggested does exactly what I believe the OP wanted without the method that the OP assumed was the correct way of solving their problem.

sheerun · 2018-11-26T21:44:37Z

Reiterating my use case is:

setting up development environment with https self-signed certificate so Facebook integrations are working properly locally.

A programmatic way of doing so is better than setting ENV variable, so it would be OK for my use case. I'd rather use official, documented way of doing so though, so @cinderblock has a point that it should be documented.

cinderblock · 2018-11-26T22:11:45Z

@sheerun Yeah, I'm rather surprised that this API is not documented.

On the node.js tls documentation page, it simply says:

The tls.createSecureContext() method creates a credentials object.

But what is a "credentials object"? I have not found any documentation on it.

It looks to be a real API for a number of reasons:

No underscores (_)
It is named in a change log
Tests use this function.
Internal code uses this API

sam-github · 2019-03-25T19:20:59Z

A number of independent issues are discussed here:

runtime setting of env variable, see discussion in Consistent environment variables #26213
relative path, it should be supported, please post reproduction if you find it to not be
confusion about what a credentials object is, see doc: remove reference to "credentials object" #26908

The reference is confusing because the object is actually of class SecureContext. There is no object with class "credentials". See: nodejs#20432 (comment)

The reference is confusing because the object is actually of class SecureContext. There is no object with class "credentials". See: #20432 (comment) PR-URL: #26908 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Modifies the tls.rootCertificates property so that it is settable. PEM-formatted certificates set to the property are loaded into a new Node.js root certificate store that is used for all subsequent TLS requests and peer certificate validation. Allows full programmatic control of a Node.js process' root certificate store. Fixes: nodejs#20432 Refs: nodejs#27079

Modifies the tls.rootCertificates property so that it is settable. PEM-formatted certificates set to the property are loaded into a new Node.js root certificate store that is used for all subsequent TLS requests and peer certificate validation. Allows full programmatic control of a Node.js process' root certificate store. Fixes: nodejs#20432 Refs: nodejs#27079 Changed root_cert_store to a smart pointer Added support for empty root certificates Added comment

nickwesselman · 2021-01-27T23:12:07Z

This is a real bummer. Just implemented dotenv assuming that it would allow us to populate NODE_EXTRA_CA_CERTS and this ended up being decidedly not the case.

Fixes: nodejs#20432

Fixes: #20432 PR-URL: #37562 Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called. When NODE_EXTRA_CA_CERTS is specified, the root certificates (both bundled and extra) will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. The original reason NODE_EXTRA_CA_CERTS were loaded at startup (issues nodejs#20432, nodejs#20434) was to prevent the environment variable from being changed at runtime. This change preserves the runtime consistency without actually having to load the certs at startup. Fixes: nodejs#32010 Refs: nodejs#40524 Refs: nodejs#23354

Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called, rather than losing them when unrelated options are provided. When NODE_EXTRA_CA_CERTS is specified, the root certificates (both bundled and extra) will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is omitted. The original reason NODE_EXTRA_CA_CERTS were loaded at startup (issues #20432, #20434) was to prevent the environment variable from being changed at runtime. This change preserves the runtime consistency without actually having to load the certs at startup. Fixes: #32010 Refs: #40524 Refs: #23354 PR-URL: #44529 Reviewed-By: Tim Perry <pimterry@gmail.com>

bnoordhuis added the doc Issues and PRs related to the documentations. label Apr 30, 2018

bnoordhuis mentioned this issue Apr 30, 2018

src: load NODE_EXTRA_CA_CERTS at startup #20434

Closed

oyyd mentioned this issue Oct 9, 2018

tls: load NODE_EXTRA_CA_CERTS at startup #23354

Merged

4 tasks

sam-github added the feature request Issues that request new features to be added to Node.js. label Mar 25, 2019

sam-github mentioned this issue Mar 25, 2019

doc: remove reference to "credentials object" #26908

Closed

4 tasks

sam-github added a commit to sam-github/node that referenced this issue Mar 25, 2019

doc: remove reference to "credentials object"

d4ce20b

The reference is confusing because the object is actually of class SecureContext. There is no object with class "credentials". See: nodejs#20432 (comment)

cinderblock mentioned this issue Apr 3, 2019

Documented way to add certificates to existing SecureContext #27079

Open

kevjames3 mentioned this issue Nov 18, 2020

[Feature Request] Add way of running a script as a "before run" that runs before Jest executes firsttris/vscode-jest-runner#123

Closed

nickwesselman mentioned this issue Jan 28, 2021

[sitecore-jss-dev-tools][sitecore-jss-cli] Replace old and security vulnerable 'request' NPM package with axios Sitecore/jss#541

Merged

9 tasks

jasnell added a commit to jasnell/node that referenced this issue Mar 1, 2021

doc: document that NODE_EXTRA_CA_CERTS is read only once

1269400

Fixes: nodejs#20432

jasnell mentioned this issue Mar 1, 2021

doc: document that NODE_EXTRA_CA_CERTS is read only once #37562

Closed

jasnell closed this as completed in 9c1274a Mar 5, 2021

ebickle mentioned this issue Sep 6, 2022

crypto: add extra CA certs to all secure contexts #44529

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NODE_EXTRA_CA_CERTS cannot be set in code or relative #20432

NODE_EXTRA_CA_CERTS cannot be set in code or relative #20432

sheerun commented Apr 30, 2018 •

edited

Loading

bnoordhuis commented Apr 30, 2018

sheerun commented Apr 30, 2018

sheerun commented Apr 30, 2018 •

edited

Loading

sheerun commented Apr 30, 2018

bnoordhuis commented Apr 30, 2018

bnoordhuis commented Apr 30, 2018

cinderblock commented Nov 26, 2018

sam-github commented Nov 26, 2018

cinderblock commented Nov 26, 2018

sheerun commented Nov 26, 2018

cinderblock commented Nov 26, 2018

sam-github commented Mar 25, 2019

nickwesselman commented Jan 27, 2021

NODE_EXTRA_CA_CERTS cannot be set in code or relative #20432

NODE_EXTRA_CA_CERTS cannot be set in code or relative #20432

Comments

sheerun commented Apr 30, 2018 • edited Loading

bnoordhuis commented Apr 30, 2018

sheerun commented Apr 30, 2018

sheerun commented Apr 30, 2018 • edited Loading

sheerun commented Apr 30, 2018

bnoordhuis commented Apr 30, 2018

bnoordhuis commented Apr 30, 2018

cinderblock commented Nov 26, 2018

sam-github commented Nov 26, 2018

cinderblock commented Nov 26, 2018

sheerun commented Nov 26, 2018

cinderblock commented Nov 26, 2018

sam-github commented Mar 25, 2019

nickwesselman commented Jan 27, 2021

sheerun commented Apr 30, 2018 •

edited

Loading

sheerun commented Apr 30, 2018 •

edited

Loading