crypto: use system CAs instead of bundled ones #8334

AdamMajer · 2016-08-30T12:35:45Z

Checklist

make -j4 test (UNIX), or vcbuild test nosign (Windows) passes
commit message follows commit guidelines

Affected core subsystem(s)

crypto

Description of change

Use system supplied CAs instead of using Node's bundled version.
This is a compile time option with default reverting back to
using bundled certificates.

Also simplify cert_store lifetime by using reference count instead
of pulling it from under the SSL_CTX right before deletion. (merged)

addaleax · 2016-08-30T12:39:36Z

/cc @nodejs/crypto

addaleax · 2016-08-30T13:21:54Z

@AdamMajer Here typically Fixes: and full URIs are used when referencing issues to be closed :)

Here’s a CI run: https://ci.nodejs.org/job/node-test-commit/4835/

AdamMajer · 2016-08-30T14:02:54Z

@addaleax ah ,yes of couse. I'm completely new to NodeJS code review, but it seems that all commit messages have PR-URL: and Reviewed-By:. so is it correct to assume that once pull requests are reviewed, I amend the commit message with these extra headers (And fix my Fixes: header :)) ?

addaleax · 2016-08-30T14:05:22Z

@AdamMajer Usually, the person who lands the PR adds these review headers (the ones you named), but it’s not like there’s anything stopping you from adding PR-URL: https://github.com/nodejs/node/pull/8334 yourself. :)

jasnell · 2016-08-30T14:12:32Z

I know that @rvagg had suggested that this is best done as a configure option but I can definitely see value in this as a runtime command-line flag also -- even if left undocumented for the time being.

AdamMajer · 2016-08-30T14:53:50Z

Having it as runtime option is OK in rare situation, maybe if you need to specify multiple stores? But then can't that be done already with the environmental variables SSL_CERT_DIR and SSL_CERT_FILE? Enable this at compile time, then select various stores with environmental variables overriding OpenSSL defaults. That's how I understand it from quick grep through OpenSSL.

An alternative would be to have compile time option "no-bundled-ca-certs" with runtime override option (no-)use-bundled-ca-certs (or something like that),

look for system CAs as primary (including the environmental variables)
fall back bundled CAs unless runtime/compiletime flag set to not use them.

The idea behind compile time selection is to make like easier for Linux distributions (and their users) where bundled CAs are very bad idea. On Linux we definitely would not want to fallback to bundled CAs. But there are quite a per different permutations on how this can be done.

dougwilson · 2016-08-30T15:15:34Z

Would this make it possible to use the Windows system cert store?

Fishrock123 · 2016-08-30T15:34:05Z

Fixes #3159.

Being able to specify a path to root CAs at may also be useful. I think that would be more suited as a runtime flag?

indutny · 2016-08-30T16:43:07Z

configure

@@ -905,6 +910,8 @@ def configure_openssl(o):
  o['variables']['node_use_openssl'] = b(not options.without_ssl)
  o['variables']['node_shared_openssl'] = b(options.shared_openssl)
  o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0
+  if options.use_system_ca_store:
+    o['defines'] += ['USE_SYSTEM_CERTIFICATE_STORE']


Let's prefix it NODE_, may be something like NODE_SYSTEM_CERT_STORE?

AdamMajer · 2016-08-30T17:01:37Z

On 08/30/2016 05:15 PM, Douglas Wilson wrote:

Would this make it possible to use the Windows system cert store?

For this better question would be, does OpenSSL support using Windows
cert store? I have no idea.

indutny · 2016-08-30T17:21:28Z

LGTM with a define naming nit, unless @bnoordhuis has some comments.

jasnell · 2016-08-30T18:16:09Z

Having it as runtime option is OK in rare situation, maybe if you need to specify multiple stores?

For one, it would make it easier/possible to test this in CI :-)

dougwilson · 2016-08-30T18:26:04Z

For this better question would be, does OpenSSL support using Windows cert store? I have no idea.

Yea, I have no idea, that's why I was asking :) Your config parameter along with it's description would suggest it does, and that it is not restricted to whatever OpenSSL happens to do. Some Googling suggests that no, OpenSSL cannot use the Windows cert store (but I have no idea how to verify those claims), which seems to make the configure switch misleading(?)

AdamMajer · 2016-08-31T09:45:09Z

Updated to use suggested define name. Minor change to comment, but otherwise same patch.

The runtime option can be done later. The compile time option still needs to be there for 2 reasons,

to not change current default behavior . maybe in node 7 we can delegate root certs to OS only as it should be possible on windows too, see http://stackoverflow.com/questions/9507184/can-openssl-on-windows-use-the-system-certificate-store but I'm not sure whether this belongs in Node or OpenSSL.
all Linux distros would prefer to manage CAs in one place. Here they need to change current default behavior.

One step at a time .

jasnell · 2016-08-31T14:36:47Z

LGTM. It's a shame that we don't have a direct way of testing this in CI since we can't set compile time flags for CI. I would say that this should likely be considered to be unsupported/experimental until it's gone through at least one release and we can see if any issues come up on it.

bnoordhuis · 2016-09-05T08:16:29Z

src/node_crypto.cc

@@ -751,6 +751,23 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
  CHECK_EQ(sc->ca_store_, nullptr);

  if (!root_cert_store) {
+#if defined(NODE_SYSTEM_CERT_STORE)
+    // *Assume* OpenSSL is setup correctly, which is the case
+    // for distribution supplied versions.


That's only going to be the case when node is linked against the distro openssl. It defaults to /usr/local/ssl with the bundled copy and that's unlikely to be the right path.

Aside: s/setup/set up/

Actually, this does not appear to be the case. Look in openssl.gypi. I've tested this with OpenSUSE Leap 42.1 which needs bundled OpenSSL and it certainly uses the /etc/ssl path as defined in the openssl.gypi file.

@bnoordhuis I agree with @AdamMajer here, node's copy of OpenSSL uses a cert path in /etc, not /usr/local

The pointer to std::vector is unnecessary, so replace it with standard instance. Also, make the for() loop more readable by using actual type instead of inferred - there is no readability benefit here from obfuscating the type. PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

NodeJS can already use an external, shared OpenSSL library. This library knows where to look for OS managed certificates. Allow a compile-time option to use this CA store by default instead of using bundled certificates. In case when using bundled OpenSSL, the paths are also valid for majority of Linux systems without additional intervention. If this is not set, we can use SSL_CERT_DIR to point it to correct location. Fixes: #3159 PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

The pointer to std::vector is unnecessary, so replace it with standard instance. Also, make the for() loop more readable by using actual type instead of inferred - there is no readability benefit here from obfuscating the type. PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

NodeJS can already use an external, shared OpenSSL library. This library knows where to look for OS managed certificates. Allow a compile-time option to use this CA store by default instead of using bundled certificates. In case when using bundled OpenSSL, the paths are also valid for majority of Linux systems without additional intervention. If this is not set, we can use SSL_CERT_DIR to point it to correct location. Fixes: #3159 PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

PR-URL: #8334 Backport-PR-URL: #11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

This LTS release comes with 126 commits. This includes 40 which are test related, 32 which are doc related, 12 which are build / tool related and 4 commits which are updates to dependencies. Notable Changes: * build: - support for building mips64el (nanxiongchao) #10991 * cluster: - disconnect() now returns a reference to the disconnected worker. (Sean Villars) #10019 * crypto: - ability to select cert store at runtime (Adam Majer) #8334 - Use system CAs instead of using bundled ones (Adam Majer) #8334 - The `Decipher` methods `setAuthTag()` and `setAAD` now return `this`. (Kirill Fomichev) #9398 - adding support for OPENSSL_CONF again (Sam Roberts) #11006 - make LazyTransform compabile with Streams1 (Matteo Collina) #12380 * deps: - upgrade libuv to 1.11.0 (cjihrig) #11094 - upgrade libuv to 1.10.2 (cjihrig) #10717 - upgrade libuv to 1.10.1 (cjihrig) #9647 - upgrade libuv to 1.10.0 (cjihrig) #9267 * dns: - Implemented `{ttl: true}` for `resolve4()` and `resolve6()` (Ben Noordhuis) #9296 * process: - add NODE_NO_WARNINGS environment variable (cjihrig) #10842 * readline: - add option to stop duplicates in history (Danny Nemer) #2982 * src: - support "--" after "-e" as end-of-options (John Barboza) #10651 * tls: - new tls.TLSSocket() supports sec ctx options (Sam Roberts) #11005 - Allow obvious key/passphrase combinations. (Sam Roberts) #10294 PR-URL: #13059

The pointer to std::vector is unnecessary, so replace it with standard instance. Also, make the for() loop more readable by using actual type instead of inferred - there is no readability benefit here from obfuscating the type. PR-URL: nodejs/node#8334 Backport-PR-URL: nodejs/node#11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

NodeJS can already use an external, shared OpenSSL library. This library knows where to look for OS managed certificates. Allow a compile-time option to use this CA store by default instead of using bundled certificates. In case when using bundled OpenSSL, the paths are also valid for majority of Linux systems without additional intervention. If this is not set, we can use SSL_CERT_DIR to point it to correct location. Fixes: nodejs/node#3159 PR-URL: nodejs/node#8334 Backport-PR-URL: nodejs/node#11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

PR-URL: nodejs/node#8334 Backport-PR-URL: nodejs/node#11794 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

This LTS release comes with 126 commits. This includes 40 which are test related, 32 which are doc related, 12 which are build / tool related and 4 commits which are updates to dependencies. Notable Changes: * build: - support for building mips64el (nanxiongchao) nodejs/node#10991 * cluster: - disconnect() now returns a reference to the disconnected worker. (Sean Villars) nodejs/node#10019 * crypto: - ability to select cert store at runtime (Adam Majer) nodejs/node#8334 - Use system CAs instead of using bundled ones (Adam Majer) nodejs/node#8334 - The `Decipher` methods `setAuthTag()` and `setAAD` now return `this`. (Kirill Fomichev) nodejs/node#9398 - adding support for OPENSSL_CONF again (Sam Roberts) nodejs/node#11006 - make LazyTransform compabile with Streams1 (Matteo Collina) nodejs/node#12380 * deps: - upgrade libuv to 1.11.0 (cjihrig) nodejs/node#11094 - upgrade libuv to 1.10.2 (cjihrig) nodejs/node#10717 - upgrade libuv to 1.10.1 (cjihrig) nodejs/node#9647 - upgrade libuv to 1.10.0 (cjihrig) nodejs/node#9267 * dns: - Implemented `{ttl: true}` for `resolve4()` and `resolve6()` (Ben Noordhuis) nodejs/node#9296 * process: - add NODE_NO_WARNINGS environment variable (cjihrig) nodejs/node#10842 * readline: - add option to stop duplicates in history (Danny Nemer) nodejs/node#2982 * src: - support "--" after "-e" as end-of-options (John Barboza) nodejs/node#10651 * tls: - new tls.TLSSocket() supports sec ctx options (Sam Roberts) nodejs/node#11005 - Allow obvious key/passphrase combinations. (Sam Roberts) nodejs/node#10294 PR-URL: nodejs/node#13059

nodejs/node#3159 nodejs/node#8334 nodejs/node@3aa17e4

aguynamedben · 2019-02-22T02:16:42Z

This was a while ago, but I'm curious if the runtime option ever got worked on? I have customers who install my app and I'd like for my app to use system-installed CAs on macOS. I think I'd have to build Node native module to access the certificates in Keychain Access, though, similar to how node-keytar does.

Any tips for telling Node to use system certs on macOS at runtime?

sam-github · 2019-02-22T18:06:54Z

No work was done on Node.js side. You might want to ask on the openssl-users mailing list if OpenSSL has a mechanism for doing this.

FranklinYu · 2019-03-27T00:56:32Z

~~@sam-github Isn’t node --use-openssl-ca the “runtime option”? Did I miss anything?~~

Sorry didn’t saw that @aguynamedben was asking for macOS and Keychain.

NodeJS can already use an external, shared OpenSSL library. This library knows where to look for OS managed certificates. Allow a compile-time option to use this CA store by default instead of using bundled certificates. In case when using bundled OpenSSL, the paths are also valid for majority of Linux systems without additional intervention. If this is not set, we can use SSL_CERT_DIR to point it to correct location. Fixes: nodejs/node#3159 PR-URL: nodejs/node#8334 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. build Issues and PRs related to build files or the CI. labels Aug 30, 2016

addaleax added the openssl Issues and PRs related to the OpenSSL dependency. label Aug 30, 2016

AdamMajer mentioned this pull request Aug 30, 2016

please provide a way to use system-installed root certificates instead of bundled ones #3159

Closed

jasnell changed the title ~~Distro crypto~~ crypto: use system CAs instead of bundled ones Aug 30, 2016

indutny reviewed Aug 30, 2016
View reviewed changes

AdamMajer force-pushed the distro_crypto branch from b95d276 to 257910e Compare August 31, 2016 09:36

AdamMajer mentioned this pull request Aug 31, 2016

Node uses an hardcoded list of certificate authorities #4175

Closed

bnoordhuis reviewed Sep 5, 2016
View reviewed changes

AdamMajer force-pushed the distro_crypto branch from 257910e to 0463c07 Compare September 6, 2016 13:52

gibfahn mentioned this pull request Mar 17, 2017

Potential Semver Minor Backports nodejs/Release#188

Closed

31 tasks

MylesBorins added land-on-v6.x and removed lts-watch-v4.x labels May 16, 2017

MylesBorins mentioned this pull request May 23, 2017

v6.11.0 proposal #13059

Merged

grahamaj mentioned this pull request May 25, 2017

Configure the nodejs build to use os CA store smanders/externpro#140

Closed

djKianoosh mentioned this pull request Jun 13, 2017

Error: unable to get local issuer certificate lwsjs/local-web-server#65

Closed

timbru31 mentioned this pull request Jun 29, 2017

main/nodejs: upgrade to 6.11.0 alpinelinux/aports#1789

Closed

pld-gitsync pushed a commit to pld-linux/nodejs that referenced this pull request Nov 2, 2017

Use OpenSSL supplied CA store instead of compiled-in Mozilla CA copy.

e2a62df

nodejs/node#3159 nodejs/node#8334 nodejs/node@3aa17e4

JPvRiel mentioned this pull request May 22, 2018

CA File atom/apm#340

Open

FranklinYu mentioned this pull request Jun 9, 2020

Trust the system root CA certificates yarnpkg/yarn#6578

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: use system CAs instead of bundled ones #8334

crypto: use system CAs instead of bundled ones #8334

AdamMajer commented Aug 30, 2016 •

edited

Loading

addaleax commented Aug 30, 2016

addaleax commented Aug 30, 2016

AdamMajer commented Aug 30, 2016

addaleax commented Aug 30, 2016

jasnell commented Aug 30, 2016

AdamMajer commented Aug 30, 2016

dougwilson commented Aug 30, 2016

Fishrock123 commented Aug 30, 2016

indutny Aug 30, 2016

AdamMajer commented Aug 30, 2016

indutny commented Aug 30, 2016

jasnell commented Aug 30, 2016

dougwilson commented Aug 30, 2016

AdamMajer commented Aug 31, 2016

jasnell commented Aug 31, 2016

bnoordhuis Sep 5, 2016

AdamMajer Sep 6, 2016

sam-github Oct 27, 2016

aguynamedben commented Feb 22, 2019

sam-github commented Feb 22, 2019

FranklinYu commented Mar 27, 2019 •

edited

Loading

crypto: use system CAs instead of bundled ones #8334

crypto: use system CAs instead of bundled ones #8334

Conversation

AdamMajer commented Aug 30, 2016 • edited Loading

Checklist

Affected core subsystem(s)

Description of change

addaleax commented Aug 30, 2016

addaleax commented Aug 30, 2016

AdamMajer commented Aug 30, 2016

addaleax commented Aug 30, 2016

jasnell commented Aug 30, 2016

AdamMajer commented Aug 30, 2016

dougwilson commented Aug 30, 2016

Fishrock123 commented Aug 30, 2016

indutny Aug 30, 2016

Choose a reason for hiding this comment

AdamMajer commented Aug 30, 2016

indutny commented Aug 30, 2016

jasnell commented Aug 30, 2016

dougwilson commented Aug 30, 2016

AdamMajer commented Aug 31, 2016

jasnell commented Aug 31, 2016

bnoordhuis Sep 5, 2016

Choose a reason for hiding this comment

AdamMajer Sep 6, 2016

Choose a reason for hiding this comment

sam-github Oct 27, 2016

Choose a reason for hiding this comment

aguynamedben commented Feb 22, 2019

sam-github commented Feb 22, 2019

FranklinYu commented Mar 27, 2019 • edited Loading

AdamMajer commented Aug 30, 2016 •

edited

Loading

FranklinYu commented Mar 27, 2019 •

edited

Loading