From 12694002ffb70638cc3304a2b6385afb76756133 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Mon, 1 Mar 2021 14:00:18 -0800
Subject: [PATCH] doc: document that NODE_EXTRA_CA_CERTS is read only once

Fixes: https://github.com/nodejs/node/issues/20432
---
 doc/api/cli.md                  | 4 ++++
 doc/node.1                      | 7 +++++++
 lib/internal/main/print_help.js | 2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index a8df8b410271a0..297058db2f7bbe 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -1312,6 +1312,10 @@ options property is explicitly specified for a TLS or HTTPS client or server.
 This environment variable is ignored when `node` runs as setuid root or
 has Linux file capabilities set.
 
+The `NODE_EXTRA_CA_CERTS` environment variable is only read when the Node.js
+process is first launched. Changing the value at runtime using
+`process.env.NODE_EXTRA_CA_CERTS` has no effect on the current process.
+
 ### `NODE_ICU_DATA=file`
 <!-- YAML
 added: v0.11.15
diff --git a/doc/node.1 b/doc/node.1
index 6b091f5a795f42..10af523bde1275 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -576,6 +576,13 @@ but any errors are otherwise ignored.
 .Pp
 This environment variable is ignored when `node` runs as setuid root or
 has Linux file capabilities set.
+.Pp
+The
+.Ar NODE_EXTRA_CA_CERTS
+environment variable is only read when the Node.js process is first launched.
+Changing the value at runtime using
+.Ar process.env.NODE_EXTRA_CA_CERTS
+has no effect on the current process.
 .
 .It Ev NODE_ICU_DATA Ar file
 Data path for ICU (Intl object) data.
diff --git a/lib/internal/main/print_help.js b/lib/internal/main/print_help.js
index 03294a9e378f4d..0bb9459bfa59fc 100644
--- a/lib/internal/main/print_help.js
+++ b/lib/internal/main/print_help.js
@@ -39,7 +39,7 @@ const envVars = new SafeMap(ArrayPrototypeConcat([
   ['NODE_DISABLE_COLORS', { helpText: 'set to 1 to disable colors in ' +
     'the REPL' }],
   ['NODE_EXTRA_CA_CERTS', { helpText: 'path to additional CA certificates ' +
-    'file' }],
+    'file. Only read once during process startup.' }],
   ['NODE_NO_WARNINGS', { helpText: 'set to 1 to silence process warnings' }],
   ['NODE_PATH', { helpText: `'${require('path').delimiter}'-separated list ` +
     'of directories prefixed to the module search path' }],