Hardcoded list of certificate authorities

[hzzyy1997-sudo]

Is there any way to compile nodejs without the default list of root certificates?
Or is there a reason why nodejs chooses to have a builtin root CA list instead of dynamiclly loading root CAs at runtime?

[richardlau]

The root certificates are in src/node_root_certs.h (see https://github.com/nodejs/node/blob/master/doc/guides/maintaining-root-certs.md). You'll need to patch those out/supply alternatives.

[hzzyy1997-sudo]

Thanks for your answer. I've tried two ways to patch out these certificates. 1. delete all certificate strings in node_root_certs.h 2. replace certificate strings in node_root_certs.h with empty strings. However, 1. when compiling with empty node_root_certs.h, error occurs during compilation of node_crypto.cc since arraysize() function was called on the array constructed from node_root_certs.h. 2. when compiling with empty strings in node_root_certs.h, node will successfully compile, but it will abort when I try to add extra certificates becuase there is an assertion to make sure the X509_STORE is not a nullptr.