Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure the nodejs build to use os CA store #140

Closed
grahamaj opened this issue May 25, 2017 · 4 comments
Closed

Configure the nodejs build to use os CA store #140

grahamaj opened this issue May 25, 2017 · 4 comments
Assignees
Labels
Milestone

Comments

@grahamaj
Copy link

grahamaj commented May 25, 2017

This issue is a request to update node and build it with the new flag --use-openssl-ca to use openssl's certificate store

Explaination
The default behavior for Nodejs is to bundle a snapshot of Mozilla CA (certificate authority) store into the build. This means that the default CA store is fixed upon building node. This is also not very helpful for non standard CA's.

As of Node 7.5.0 and the future release 6.11.0 node can be built to use openssl's certificate store

From node's build script readme file:

Using OpenSSL store allows for external modifications of the store. For most
Linux and BSD distributions, this store is maintained by the distribution
maintainers and system administrators. OpenSSL CA store location is dependent on
configuration of the OpenSSL library but this can be altered at runtime using
environmental variables.

Reference
Openssl CA support for Nodejs 7.5.0: node pull 8334
Node 6.11.0 proposal including the fix for the LTS verison: node pull 13059

@smanders smanders added this to the next milestone May 25, 2017
@smanders smanders modified the milestones: next, current Sep 29, 2017
@smanders smanders modified the milestones: current, next Oct 9, 2017
@smanders
Copy link
Owner

smanders commented Oct 9, 2017

I discussed this with @grahamaj today -- we'll put this off until the next release of externpro

@grahamaj
Copy link
Author

grahamaj commented Nov 3, 2017

@smanders This may be a noop. It appears that we might be able to use a command line argument at runtime rather than specifying it at build time. See https://nodejs.org/dist/latest-v6.x/docs/api/cli.html#cli_use_openssl_ca_use_bundled_ca

@smanders smanders removed the update label Nov 3, 2017
@smanders
Copy link
Owner

smanders commented Nov 3, 2017

removed "update" label since we now build v6.11.4 which has this feature (if we need to modify the build) -- when this issue was first written we needed to update to at least 6.11.0 and then add the enhancement

@smanders smanders self-assigned this Aug 29, 2019
@smanders smanders modified the milestones: next, current Aug 29, 2019
@smanders
Copy link
Owner

@grahamaj please let me know if we need to consider doing this in the future... for now I'm closing this issue as "won't fix" - thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants