Skip to content
This repository has been archived by the owner on Apr 22, 2023. It is now read-only.

tls: Use OpenSSL default trusted CA list and allow configuration of the trusted CA path #25363

Closed
wants to merge 2 commits into from

Commits on May 20, 2015

  1. tls: Use the OpenSSL default trusted CA list if available

    node.js previously only used a hard-coded list of CA certificates defined in
    src/node_root_certs.h.  This made it difficult for system
    administrators to update the CA list or add/remove CAs, as the CA list
    both required a recompile of node.js to make changes and required
    managing the node.js CA list independently from the CA list used by
    other OpenSSL applications on the system.
    
    With this change, node.js will instead use the OpenSSL default CA list
    (whose path is defined at OpenSSL compile-time but may be overridden
    using the SSL_CERT_FILE or SSL_CERT_DIR environment variables), which
    allows node.js to use the same system-wide CA list as other
    OpenSSL-based programs, and allows system administrators to easily
    update or customize the CA list in a central location without the need
    to recompile node.js.  The hard-coded CA list is retained, but is only
    used if the OpenSSL default CA list is not available.
    PaulSD committed May 20, 2015
    Configuration menu
    Copy the full SHA
    240fa60 View commit details
    Browse the repository at this point in the history

Commits on May 21, 2015

  1. tls: New options to use a trusted CA list from a file or path

    node.js currently accepts a 'ca' option to override the default trusted
    CA list, however trusted CAs must be manually loaded into a javascript
    array by the caller to use this option.
    
    This change adds additional 'caFile' and 'caPath' options which allow
    callers to specify the path to a file or path containing trusted CA
    certificates.  This allows the trusted CA list to be overridden in the
    same manner as is allowed by other OpenSSL-based applications.
    PaulSD committed May 21, 2015
    Configuration menu
    Copy the full SHA
    12d2a43 View commit details
    Browse the repository at this point in the history