Repository navigation
Tracking issue: custom CA certificate support #58990
Description
Trying to track the recent changes that allow easier configuration of custom CA certificate for constrained environments and the backports
- Support
--use-system-cafor macOS feat: added support for reading certificates from macOS system store #56599 - Support
--use-system-cafor Windows crypto: support --use-system-ca on Windows #56833 - Support
--use-system-cafor other Unix-like platforms: crypto: support --use-system-ca on non-Windows and non-macOS #57009 - JS API to query CA certificates: tls: implement tls.getCACertificates() #57107
- JS API to configure the CA certificates crypto: add tls.setDefaultCACertificates() #58822
- Encouraging use of
--use-system-cain certificate errors: Suggest --use-system-ca when a certificate error occurs #57362 - Fixing leak of
--use-system-cacrypto: fix X509* leak in --use-system-ca #56832 - Add NODE_USE_SYSTEM_CA=1 cli: add NODE_USE_SYSTEM_CA=1 #59276
- Load system CA certificates off thread crypto: load system CA certificates off thread #59550
- Only load certificates off thread when tls is used tls: only do off-thread certificate loading on loading tls #59856
- Make
--use-system-caa per-env option so that workers can enable/disable them individually Make --use-system-ca per-env rather than per-process #60678 - Graceful handling of invalid certificates: src: enable X509sToArrayOfStrings to skip errors #61784 crypto: improve system certificate enumeration logic on macOS #62576
- Implement certificate distrust on Windows to match Chromium's policy:
node/src/crypto/crypto_context.cc
Lines 647 to 648 in 5623194
- Make NODE_USE_SYSTEM_CA=0 disable system CA if it gets enabled by default
- Provide a build-time option to enable
--use-system-caby default - Enable --use-system-ca by default
Activity
gengjiawen commentedon Jul 23, 2025
will use-system-ca default to true in next major ?
Node.js is the only software I know doesn't respect system CA, really weird behavior.
joyeecheung commentedon Jul 29, 2025
Currently this still has a non-trivial performance overhead on the first TLS connection. We'll need to check and see if that can be mitigated or reduced.
EmperorArthur commentedon Aug 5, 2025
Python requires that
trustorebe installed, and pip only recently stopped requiring an experimental flag.I do agree it's a bit of a pain though. Especially in corporate environments.
joyeecheung commentedon Aug 20, 2025
I found a way to minimize the performance impact - #59550 with this I think there would be a much smaller performance impact to enable it by default.
amilshahsahab commentedon Aug 23, 2025
crypto: load system CA certificates off thread
crypto: load system CA certificates off thread
crypto: load system CA certificates off thread
gengjiawen commentedon May 13, 2026
I found this really annoying for enterprise user, if user have enterprise cert installed globally, so fetch won't work. Maybe also add a runtime check or env check since --use-system-ca not by default?
joyeecheung commentedon May 13, 2026
It's unclear to me what runtime checks etc. means. There are runtime APIs for querying and setting certificates that users can invoke, but from a runtime point of view, Node.js has no way of knowing what the system certificates are. Most systems likely have some certificates different from the Mozilla bundle, so if the signal is that there is some difference then practically it's enabling by default.
github-actions commentedon Aug 12, 2026
This issue has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.