tls: add OpenSSL CA lookup to getCACertificates

[Archkon]

Fixes: #64258

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/net

[Archkon]

@joyeecheung
I’m not sure whether we should add support for the OpenSSL CA flag when developers pass the default type.

The existing behavior with OpenSSL CAs is that, during TLS connection setup, OpenSSL performs hash-based lookups for certificates. However, that behavior is not synchronized with what tls.getCACertificates('default') returns.

Another possibility would be to allow the default type to accept a second lookup argument, but that seems to duplicate the purpose of adding a separate openssl type.

Could you review the code by the way ? I really don't know how to support subject parse which maybe implement a
OpenSSL/RFC2253 subject parser ?

[joyeecheung]

Another possibility would be to allow the default type to accept a second lookup argument, but that seems to duplicate the purpose of adding a separate openssl type.

There's also NODE_EXTRA_CA_CERTS to consider:

// Flags: --use-openssl-ca
tls.getCACertificates('default');   // Either warn or error about no issuer name to filter for
tls.getCACertificates('default', cert);  // Does not warn and perform a similar hash lookup for system certs, + extra certs from NODE_EXTRA_CA_CERTS if any
tls.getCACertificates('openssl', cert);  // Similar, but no certs from NODE_EXTRA_CA_CERTS

[Archkon]

Another possibility would be to allow the default type to accept a second lookup argument, but that seems to duplicate the purpose of adding a separate openssl type.

There's also NODE_EXTRA_CA_CERTS to consider:

// Flags: --use-openssl-ca
tls.getCACertificates('default');   // Either warn or error about no issuer name to filter for
tls.getCACertificates('default', cert);  // Does not warn and perform a similar hash lookup for system certs, + extra certs from NODE_EXTRA_CA_CERTS if any
tls.getCACertificates('openssl', cert);  // Similar, but no certs from NODE_EXTRA_CA_CERTS

@joyeecheung
So are we only allowing this API to accept certificates as valid arguments, while dropping support for subject name ? And one more thing, I need calrification about how to deal with developers who call tls.getCACertificates('openssl', cert);without --use-openssl-ca as flag to pass? allow or not?

[codecov]

Codecov Report

❌ Patch coverage is 85.62500% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.24%. Comparing base (6eff679) to head (d700f3c).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_context.cc	74.39%	10 Missing and 11 partials ⚠️
lib/tls.js	97.43%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64269      +/-   ##
==========================================
+ Coverage   90.23%   90.24%   +0.01%     
==========================================
  Files         741      741              
  Lines      241342   241527     +185     
  Branches    45474    45522      +48     
==========================================
+ Hits       217767   217972     +205     
+ Misses      15123    15101      -22     
- Partials     8452     8454       +2     

Files with missing lines	Coverage Δ
lib/tls.js	93.55% <97.43%> (+0.41%)	⬆️
src/crypto/crypto_context.cc	72.52% <74.39%> (+0.24%)	⬆️

... and 39 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joyeecheung]

So are we only allowing this API to accept certificates as valid arguments, while dropping support for subject name ?

I think starting with a certificate makes sense (or matches a bit more with what you'd expect from OpenSSL). If anyone requests support for subject name string that can be added later.

I need calrification about how to deal with developers who call tls.getCACertificates('openssl', cert);without --use-openssl-ca as flag to pass? allow or not?

I think it's fine to allow that to work without the flag. It should return "what would've been used if the flag is used".

[Archkon]

@joyeecheung
Done,Could you review the code when avaliable? Thanks!