Should we be calling SSL_CTX_add_client_CA() always when a custom CA is set? #54787

Activity

1. addaleax

   added

   tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.

   on Sep 5, 2024
2. pimterry commented on Mar 25, 2026

   

   pimterry

   on Mar 25, 2026

   Member

   More actions

   As far as I can tell, the docs are misleading, and this chunk refers to SSL_CTX_set0_CA_list, not SSL_CTX_add_client_CA.

   In any case, in practice it seems that we never send the certificate_authorities extension in any TLS client setup I can reproduce. Example:

   const https = require('https');
   const { execSync } = require('child_process');
   const { readFileSync, unlinkSync } = require('fs');
   
   // Generate a throwaway CA to pass as the trusted CA option
   execSync(
     'openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 ' +
     '-nodes -days 1 -subj /CN=testca -keyout /tmp/ca.key -out /tmp/ca.pem 2>/dev/null'
   );
   const ca = readFileSync('/tmp/ca.pem');
   unlinkSync('/tmp/ca.key');
   unlinkSync('/tmp/ca.pem');
   
   https.get('https://testserver.host/tls/client-hello', {
     ca: [ca],
     rejectUnauthorized: false, // Our CA won't match the server's cert
   }, (res) => {
     let body = '';
     res.on('data', (d) => body += d);
     res.on('end', () => {
       const hello = JSON.parse(body);
       const caExt = hello.extensions.find((e) => e.id === 47);
       console.log('Node ' + process.version + ' (OpenSSL ' + process.versions.openssl + ')');
       if (caExt) {
         console.log('FOUND certificate_authorities extension:', JSON.stringify(caExt, null, 2));
       } else {
         console.log('certificate_authorities extension: not present');
         console.log('Found extensions:', hello.extensions.map((e) => e.name));
       }
     });
   });

   I think this can be closed.
3. pimterry commented on Apr 20, 2026

   

   pimterry

   on Apr 20, 2026

   Member

   More actions

   Going to close this now, but shout if you or anybody else disagrees and I'm very happy to explore further.
4. pimterry

   closed this as not plannedon Apr 20, 2026