cli: add NODE_USE_SYSTEM_CA=1 #59276

joyeecheung · 2025-07-29T14:21:18Z

Similar to how NODE_USE_ENV_PROXY complements --use-env-proxy, this
complements --use-system-ca. This will allow the setting to be
applied to workers individually in the future.

nodejs-github-bot · 2025-07-29T14:21:24Z

Review requested:

@nodejs/startup

codecov · 2025-07-29T15:12:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.91%. Comparing base (a73b575) to head (d23c5e8).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #59276   +/-   ##
=======================================
  Coverage   89.91%   89.91%           
=======================================
  Files         655      655           
  Lines      192866   192871    +5     
  Branches    37806    37803    -3     
=======================================
+ Hits       173412   173420    +8     
+ Misses      12015    12002   -13     
- Partials     7439     7449   +10

Files with missing lines	Coverage Δ
src/node.cc	`75.10% <100.00%> (+0.17%)`	⬆️

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jasnell · 2025-07-29T16:55:01Z

test/parallel/test-tls-get-ca-certificates-node-use-system-ca.js

+const { child: { stdout: expectedLength } } = spawnSyncAndExitWithoutError(process.execPath, [
+  '--use-system-ca',
+  '-p',
+  `tls.getCACertificates('default').length`,


super nit... just have a preference to avoid template literals when unnecessary. but feel free to ignore.

Suggested change

`tls.getCACertificates('default').length`,

'tls.getCACertificates("default").length',

I have am impression that double quotes in an argument don't work very well on Windows. I could give it a try and see if it works though if the CI comes back happy I would prefer to use single quotes (AFAIK Windows does not do anything special with single quotes).

bnoordhuis · 2025-07-29T17:07:21Z

Why not NODE_OPTIONS? That env var was specifically introduced to counter new environment variables getting introduced for every single little feature.

joyeecheung · 2025-07-30T07:49:43Z

Why not NODE_OPTIONS? That env var was specifically introduced to counter new environment variables getting introduced for every single little feature.

NODE_OPTIONS may not work so well when working with workers: #41103 - if workers controlled by another party need to override a feature to be inherited by other workers, then overriding the setting requires argument parsing on the env var, and they need to be careful to filter out arguments not supported per-worker. It would also be more consistent with the offering of NODE_USE_ENV_PROXY/--use-env-proxy which tend to be where NODE_USE_SYSTEM_CA/--use-system-ca would also be needed.

nodejs-github-bot · 2025-07-30T09:44:24Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68321/

joyeecheung · 2025-07-30T09:45:13Z

test/system-ca/test-native-root-certs-env.mjs

@@ -0,0 +1,56 @@
+// Env: NODE_USE_SYSTEM_CA=1


FYI @pmarchini when using this feature (thanks for implementing it by the way) I noticed that it does not yet have integration in test/common/index.js like the one for Flags so that when you run the test directly with node /path/to/test.js without the specified environment variable, the process would automatically pause the evaluation and spawn a child process to run itself with the environment variable instead.

node/test/common/index.js

Lines 90 to 96 in 0fd1ecd

if (process.argv.length === 2 &&

!process.env.NODE_SKIP_FLAG_CHECK &&

isMainThread &&

hasCrypto &&

require('cluster').isPrimary &&

fs.existsSync(process.argv[1])) {

const flags = parseTestFlags();

src/node.cc

nodejs-github-bot · 2025-08-02T15:27:16Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68369/

joyeecheung · 2025-08-05T20:30:56Z

Added macros to fix the withoutssl builds. @jasnell @Ethan-Arrowood @RaisinTen can you take a look again? Thanks

nodejs-github-bot · 2025-08-05T20:31:58Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68426/

nodejs-github-bot · 2025-08-06T05:40:36Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68434/

joyeecheung · 2025-08-06T13:00:42Z

Not quite sure why there is a new src\quic\data.h(159,5): error : expected identifier in the coverage Windows build. I am guessing it might need a rebase.

nodejs-github-bot · 2025-08-08T13:30:37Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68494/

nodejs-github-bot · 2025-08-08T16:04:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68497/

nodejs-github-bot · 2025-08-08T20:54:09Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68504/

nodejs-github-bot · 2025-08-08T23:01:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68506/

Similar to how NODE_USE_ENV_PROXY complements --use-env-proxy, this complements --use-system-ca. This will allow the setting to be applied to workers individually in the future.

joyeecheung · 2025-08-09T17:06:05Z

Not sure how but after the rebase the SEA tests started to fail on macOS x64. Trying to rebase again...

nodejs-github-bot · 2025-08-09T17:07:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68524/

nodejs-github-bot · 2025-08-09T21:39:11Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68528/

joyeecheung · 2025-08-10T13:59:48Z

CI is (finally) happy. This needs a re-approval after the rebase. @jasnell @legendecas @Ethan-Arrowood @RaisinTen Can you take a look again? Thanks!

gurgunday

lgtm

nodejs-github-bot · 2025-08-10T14:21:00Z

Landed in ca76b39

Similar to how NODE_USE_ENV_PROXY complements --use-env-proxy, this complements --use-system-ca. This will allow the setting to be applied to workers individually in the future. PR-URL: #59276 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449

Similar to how NODE_USE_ENV_PROXY complements --use-env-proxy, this complements --use-system-ca. This will allow the setting to be applied to workers individually in the future. PR-URL: #59276 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 * (SEMVER-MINOR) add --use-env-proxy (Joyee Cheung) #59151 * (SEMVER-MINOR) support `${pid}` placeholder in --cpu-prof-name (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 * (SEMVER-MINOR) add tls.setDefaultCACertificates() (Joyee Cheung) #58822 deps: * update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234 * upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag --experimental-wasm-modules (Guy Bedford) #57038 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Jul 29, 2025

joyeecheung mentioned this pull request Jul 29, 2025

Tracking issue: custom CA certificate support #58990

Open

8 tasks

joyeecheung force-pushed the use-system-ca-env branch from c36531e to 8b0af5b Compare July 29, 2025 15:53

jasnell reviewed Jul 29, 2025

View reviewed changes

jasnell approved these changes Jul 29, 2025

View reviewed changes

Ethan-Arrowood approved these changes Jul 29, 2025

View reviewed changes

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 30, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 30, 2025

joyeecheung commented Jul 30, 2025

View reviewed changes

RaisinTen approved these changes Jul 30, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

joyeecheung added the semver-minor PRs that contain new features and should be released in the next minor version. label Jul 30, 2025

This comment was marked as outdated.

Sign in to view

jasnell reviewed Aug 1, 2025

View reviewed changes

src/node.cc Show resolved Hide resolved

Ethan-Arrowood approved these changes Aug 5, 2025

View reviewed changes

jasnell approved these changes Aug 5, 2025

View reviewed changes

RaisinTen approved these changes Aug 6, 2025

View reviewed changes

joyeecheung force-pushed the use-system-ca-env branch from 181a476 to f4e5a43 Compare August 6, 2025 13:01

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 8, 2025

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 8, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 8, 2025

joyeecheung added 2 commits August 9, 2025 19:04

cli: add NODE_USE_SYSTEM_CA=1

0519e58

Similar to how NODE_USE_ENV_PROXY complements --use-env-proxy, this complements --use-system-ca. This will allow the setting to be applied to workers individually in the future.

fixup! cli: add NODE_USE_SYSTEM_CA=1

d23c5e8

joyeecheung force-pushed the use-system-ca-env branch from eb8d8d9 to d23c5e8 Compare August 9, 2025 17:05

legendecas approved these changes Aug 10, 2025

View reviewed changes

gurgunday approved these changes Aug 10, 2025

View reviewed changes

joyeecheung added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. labels Aug 10, 2025

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 10, 2025

nodejs-github-bot merged commit ca76b39 into nodejs:main Aug 10, 2025
60 checks passed

github-actions bot mentioned this pull request Aug 11, 2025

2025-08-12, Version 24.6.0 (Current) #59449

Merged

Jul	AUG	Sep
	14
2024	2025	2026

	`tls.getCACertificates('default').length`,
	'tls.getCACertificates("default").length',

	if (process.argv.length === 2 &&
	!process.env.NODE_SKIP_FLAG_CHECK &&
	isMainThread &&
	hasCrypto &&
	require('cluster').isPrimary &&
	fs.existsSync(process.argv[1])) {
	const flags = parseTestFlags();

Uh oh!

cli: add NODE_USE_SYSTEM_CA=1 #59276

cli: add NODE_USE_SYSTEM_CA=1 #59276

Conversation

joyeecheung commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

codecov bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jasnell Jul 29, 2025

Choose a reason for hiding this comment

Uh oh!

joyeecheung Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bnoordhuis commented Jul 29, 2025

Uh oh!

joyeecheung commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 30, 2025

Uh oh!

joyeecheung Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

nodejs-github-bot commented Aug 2, 2025

Uh oh!

joyeecheung commented Aug 5, 2025

Uh oh!

nodejs-github-bot commented Aug 5, 2025

Uh oh!

nodejs-github-bot commented Aug 6, 2025

Uh oh!

joyeecheung commented Aug 6, 2025

Uh oh!

nodejs-github-bot commented Aug 8, 2025

Uh oh!

nodejs-github-bot commented Aug 8, 2025

Uh oh!

nodejs-github-bot commented Aug 8, 2025

Uh oh!

nodejs-github-bot commented Aug 8, 2025

Uh oh!

joyeecheung commented Aug 9, 2025

Uh oh!

nodejs-github-bot commented Aug 9, 2025

Uh oh!

nodejs-github-bot commented Aug 9, 2025

Uh oh!

joyeecheung commented Aug 10, 2025

Uh oh!

gurgunday left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 10, 2025

Uh oh!

Uh oh!

codecov bot commented Jul 29, 2025 •

edited

Loading

joyeecheung Jul 30, 2025 •

edited

Loading

joyeecheung commented Jul 30, 2025 •

edited

Loading

joyeecheung Jul 30, 2025 •

edited

Loading