Skip to content

Node 8 - OpenSSL client compatibility after DST Root CA X3 expiration (Let's Encrypt) #40282

@jbeaudoin11

Description

@jbeaudoin11

Version

v8.17.0

Platform

Linux 5.4.0-87-generic #98~18.04.1-Ubuntu SMP Wed Sep 22 10:45:04 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

tls

What steps will reproduce the bug?

Any request done to a website signed by Let's Encrypt cross-signed certificate chain.

const https = require("https");
https.get("https://letsencrypt.org/", (res) => { console.log("PASS"); })

How often does it reproduce? Is there a required condition?

A cross-signed certificate chain must be in use.
For now the only one i know is the one used by Let's Encrypt.

What is the expected behavior?

PASS

What do you see instead?

Error: certificate has expired
    at TLSSocket.<anonymous> (_tls_wrap.js:1116:38)
    at emitNone (events.js:106:13)
    at TLSSocket.emit (events.js:208:7)
    at TLSSocket._finishInit (_tls_wrap.js:643:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38)

Additional information

Of Course I know that Node 8 is not supported anymore, but I'm working with an old code base. We tried multiple times to upgrade, but a memory leak, that only present it self on newer version, is stopping us each time.

The problem is with openssl, we need to add the flag X509_V_FLAG_TRUSTED_FIRST :

static const X509_VERIFY_PARAM default_table[] = {
{
"default", /* X509 default parameters */
0, /* Check time */
0, /* internal flags */
0, /* flags */
0, /* purpose */
0, /* trust */
100, /* depth */
NULL, /* policies */
vpm_empty_id},

From master branch :

static const X509_VERIFY_PARAM default_table[] = {
{
"default", /* X509 default parameters */
0, /* Check time */
0, /* internal flags */
X509_V_FLAG_TRUSTED_FIRST, /* flags */
0, /* purpose */
0, /* trust */
100, /* depth */
-1, /* auth_level */
NULL, /* policies */
vpm_empty_id},

I've tested it and it works after the change. I'm not familiar with the PR process in place, but I can do one if you want me to.

Anyways... Since the fix is extremely simple and probably affects a significant amount of people, is it possible to make an exception ? If not, we can still build from source and run our own version of Node I guess 🤷‍♂️.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions