From f1a3968a01f2d76fff3d1b677aaefc752661c448 Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Mon, 20 May 2019 11:09:02 +0200 Subject: [PATCH] tls: expose built-in root certificates Fixes: https://github.com/nodejs/node/issues/25824 PR-URL: https://github.com/nodejs/node/pull/26415 Reviewed-By: Colin Ihrig Reviewed-By: James M Snell Reviewed-By: Luigi Pinca Reviewed-By: Matteo Collina Reviewed-By: Rich Trott Reviewed-By: Ron Korving Reviewed-By: Ruben Bridgewater Reviewed-By: Sam Roberts Reviewed-By: Vse Mozhet Byt --- doc/api/tls.md | 13 + lib/tls.js | 22 +- src/node_crypto.cc | 20 ++ src/node_root_certs.h | 280 ++++++++++---------- test/parallel/test-tls-root-certificates.js | 31 +++ tools/mk-ca-bundle.pl | 2 +- 6 files changed, 225 insertions(+), 143 deletions(-) create mode 100644 test/parallel/test-tls-root-certificates.js diff --git a/doc/api/tls.md b/doc/api/tls.md index 23c9b3fb3753c3..d4c795bb3da4e1 100644 --- a/doc/api/tls.md +++ b/doc/api/tls.md @@ -1384,6 +1384,7 @@ changes: provided. For PEM encoded certificates, supported types are "TRUSTED CERTIFICATE", "X509 CERTIFICATE", and "CERTIFICATE". + See also [`tls.rootCertificates`]. * `cert` {string|string[]|Buffer|Buffer[]} Cert chains in PEM format. One cert chain should be provided per private key. Each cert chain should consist of the PEM formatted certificate for a provided private `key`, followed by the @@ -1599,6 +1600,17 @@ TLSv1.2 and below. console.log(tls.getCiphers()); // ['aes128-gcm-sha256', 'aes128-sha', ...] ``` +## tls.rootCertificates + + +* {string[]} + +An immutable array of strings representing the root certificates (in PEM format) +used for verifying peer certificates. This is the default value of the `ca` +option to [`tls.createSecureContext()`]. + ## tls.DEFAULT_ECDH_CURVE