node/test/parallel/test-tls-get-ca-certificates-extra-empty.js
Joyee Cheung a7909014f7
Some checks are pending
Coverage Linux (without intl) / coverage-linux-without-intl (push) Waiting to run
Coverage Linux / coverage-linux (push) Waiting to run
Coverage Windows / coverage-windows (push) Waiting to run
Test and upload documentation to artifacts / build-docs (push) Waiting to run
Linters / lint-addon-docs (push) Waiting to run
Linters / lint-cpp (push) Waiting to run
Linters / format-cpp (push) Waiting to run
Linters / lint-js-and-md (push) Waiting to run
Linters / lint-py (push) Waiting to run
Linters / lint-yaml (push) Waiting to run
Linters / lint-sh (push) Waiting to run
Linters / lint-codeowners (push) Waiting to run
Linters / lint-pr-url (push) Waiting to run
Linters / lint-readme (push) Waiting to run
Notify on Push / Notify on Force Push on `main` (push) Waiting to run
Notify on Push / Notify on Push on `main` that lacks metadata (push) Waiting to run
Scorecard supply-chain security / Scorecard analysis (push) Waiting to run
tls: implement tls.getCACertificates()
To accompany --use-system-ca, this adds a new API that allows
querying various kinds of CA certificates.

- If the first argument `type` is `"default"` or undefined,
  it returns the CA certificates that will be used by Node.js
  TLS clients by default, which includes the Mozilla CA
  if --use-bundled-ca is enabled or --use-openssl-ca is not
  enabled, and the system certificates if --use-system-ca
  is enabled, and the extra certificates if NODE_EXTRA_CA_CERTS
  is used.
- If `type` is `"system"` this returns the system certificates,
  regardless of whether --use-system-ca is enabeld or not.
- If `type` is `"bundled"` this is the same as `tls.rootCertificates`
  and returns the Mozilla CA certificates.
- If `type` is `"extra"` this returns the certificates parsed
  from the path specified by NODE_EXTRA_CA_CERTS.

Drive-by: remove the inaccurate description in `tls.rootCertificates`
about including system certificates, since it in fact does not include
them, and also it is contradicting the previous description about
`tls.rootCertificates` always returning the Mozilla CA store and
staying the same across platforms.

PR-URL: https://github.com/nodejs/node/pull/57107
Reviewed-By: James M Snell <jasnell@gmail.com>
2025-03-06 17:16:27 +00:00

30 lines
896 B
JavaScript

'use strict';
// This tests that tls.getCACertificates('extra') returns an empty
// array if NODE_EXTRA_CA_CERTS is empty.
const common = require('../common');
if (!common.hasCrypto) common.skip('missing crypto');
const tmpdir = require('../common/tmpdir');
const fs = require('fs');
const assert = require('assert');
const { spawnSyncAndExitWithoutError } = require('../common/child_process');
const fixtures = require('../common/fixtures');
tmpdir.refresh();
const certsJSON = tmpdir.resolve('certs.json');
// If NODE_EXTRA_CA_CERTS is not set, it should be an empty array.
spawnSyncAndExitWithoutError(process.execPath, [fixtures.path('tls-get-ca-certificates.js')], {
env: {
...process.env,
NODE_EXTRA_CA_CERTS: undefined,
CA_TYPE: 'extra',
CA_OUT: certsJSON,
}
});
const parsed = JSON.parse(fs.readFileSync(certsJSON, 'utf-8'));
assert.deepStrictEqual(parsed, []);