tls: include OpenSSL CAs in default CA list

doc/api/tls.md

@@ -2370,8 +2370,10 @@ added:
 Returns an array containing the CA certificates from various sources, depending on `type`:
 
 * `"default"`: return the CA certificates that will be used by the Node.js TLS clients by default.
-  * When [`--use-bundled-ca`][] is enabled (default), or [`--use-openssl-ca`][] is not enabled,
-    this would include CA certificates from the bundled Mozilla CA store.
+  * When [`--use-openssl-ca`][] is enabled, this would include CA certificates loaded
+    from OpenSSL's default certificate file and directory.
+  * When [`--use-bundled-ca`][] is enabled (default), this would include CA certificates
+    from the bundled Mozilla CA store.
   * When [`--use-system-ca`][] is enabled, this would also include certificates from the system's
     trusted store.
   * When [`NODE_EXTRA_CA_CERTS`][] is used, this would also include certificates loaded from the specified

lib/tls.js

@@ -43,6 +43,7 @@ const {
 const {
   getBundledRootCertificates,
   getExtraCACertificates,
+  getOpenSSLCACertificates,
   getSystemCACertificates,
   resetRootCertStore,
   getUserRootCertificates,
@@ -146,6 +147,13 @@ function cacheSystemCACertificates() {
   return systemCACertificates;
 }
 
+let opensslCACertificates;
+function cacheOpenSSLCACertificates() {
+  opensslCACertificates ||= ObjectFreeze(getOpenSSLCACertificates());
+
+  return opensslCACertificates;
+}
+
 let defaultCACertificates;
 let hasResetDefaultCACertificates = false;
 
@@ -160,7 +168,12 @@ function cacheDefaultCACertificates() {
 
   defaultCACertificates = [];
 
-  if (!getOptionValue('--use-openssl-ca')) {
+  if (getOptionValue('--use-openssl-ca')) {
+    const openssl = cacheOpenSSLCACertificates();
+    for (let i = 0; i < openssl.length; ++i) {
+      ArrayPrototypePush(defaultCACertificates, openssl[i]);
+    }
+  } else {
     const bundled = cacheBundledRootCertificates();
     for (let i = 0; i < bundled.length; ++i) {
       ArrayPrototypePush(defaultCACertificates, bundled[i]);
@@ -231,6 +244,7 @@ if (isBuildingSnapshot()) {
     // Bundled certificates are immutable so they are spared.
     extraCACertificates = undefined;
     systemCACertificates = undefined;
+    opensslCACertificates = undefined;
     if (hasResetDefaultCACertificates) {
       defaultCACertificates = undefined;
     }

src/crypto/crypto_context.cc

@@ -843,6 +843,33 @@ static void LoadCertsFromDir(std::vector<X509*>* certs,
   }
 }
 
+static void LoadCertsFromOpenSSLDirs(std::vector<X509*>* certs,
+                                     std::string_view cert_dirs) {
+#ifdef _WIN32
+  static constexpr char kOpenSSLDirSeparator = ';';
+#elif defined(__VMS)
+  static constexpr char kOpenSSLDirSeparator = ',';
+#else
+  static constexpr char kOpenSSLDirSeparator = ':';
+#endif
+
+  size_t start = 0;
+  while (start <= cert_dirs.size()) {
+    size_t end = cert_dirs.find(kOpenSSLDirSeparator, start);
+    if (end == std::string_view::npos) {
+      end = cert_dirs.size();
+    }
+    if (end > start) {
+      std::string cert_dir(cert_dirs.substr(start, end - start));
+      LoadCertsFromDir(certs, cert_dir);
+    }
+    if (end == cert_dirs.size()) {
+      break;
+    }
+    start = end + 1;
+  }
+}
+
 // Loads CA certificates from the default certificate paths respected by
 // OpenSSL.
 void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
@@ -867,7 +894,7 @@ void GetOpenSSLSystemCertificates(std::vector<X509*>* system_store_certs) {
   }
 
   if (!cert_dir.empty()) {
-    LoadCertsFromDir(system_store_certs, cert_dir.c_str());
+    LoadCertsFromOpenSSLDirs(system_store_certs, cert_dir);
   }
 }
 
@@ -1334,6 +1361,23 @@ void GetSystemCACertificates(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+void GetOpenSSLCACertificates(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  std::vector<X509*> certs;
+  GetOpenSSLSystemCertificates(&certs);
+  auto cleanup = OnScopeLeave([&certs]() {
+    for (X509* cert : certs) {
+      X509_free(cert);
+    }
+  });
+
+  Local<Array> results;
+  if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
+          .ToLocal(&results)) {
+    args.GetReturnValue().Set(results);
+  }
+}
+
 void GetExtraCACertificates(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   if (extra_root_certs_file.empty()) {
@@ -1438,6 +1482,8 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
                         GetBundledRootCertificates);
   SetMethodNoSideEffect(
       context, target, "getSystemCACertificates", GetSystemCACertificates);
+  SetMethodNoSideEffect(
+      context, target, "getOpenSSLCACertificates", GetOpenSSLCACertificates);
   SetMethodNoSideEffect(
       context, target, "getExtraCACertificates", GetExtraCACertificates);
   SetMethod(context, target, "resetRootCertStore", ResetRootCertStore);
@@ -1493,6 +1539,7 @@ void SecureContext::RegisterExternalReferences(
 
   registry->Register(GetBundledRootCertificates);
   registry->Register(GetSystemCACertificates);
+  registry->Register(GetOpenSSLCACertificates);
   registry->Register(GetExtraCACertificates);
   registry->Register(ResetRootCertStore);
   registry->Register(GetUserRootCertificates);

test/fixtures/tls-check-openssl-ca-certificates.js

@@ -0,0 +1,17 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const tls = require('tls');
+const { includesCert } = require('../common/tls');
+
+const expectedCertFiles = process.env.EXPECTED_CERT_FILES ?
+  JSON.parse(process.env.EXPECTED_CERT_FILES) : [process.env.SSL_CERT_FILE];
+const defaultCerts = tls.getCACertificates('default');
+
+for (const certFile of expectedCertFiles) {
+  const expected = fs.readFileSync(certFile, 'utf8');
+  assert(includesCert(defaultCerts, expected));
+}
+assert.strictEqual(defaultCerts, tls.getCACertificates());
+assert.strictEqual(defaultCerts, tls.getCACertificates('default'));

test/parallel/test-tls-get-ca-certificates-openssl.js

@@ -0,0 +1,43 @@
+'use strict';
+
+// This tests that tls.getCACertificates('default') includes certificates from
+// OpenSSL's default certificate file and directories when --use-openssl-ca is
+// enabled.
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const firstCertDir = tmpdir.resolve('openssl-certs-1');
+const secondCertDir = tmpdir.resolve('openssl-certs-2');
+fs.mkdirSync(firstCertDir);
+fs.mkdirSync(secondCertDir);
+
+const expectedCertFiles = [
+  fixtures.path('keys', 'ca1-cert.pem'),
+  fixtures.path('keys', 'ca2-cert.pem'),
+  fixtures.path('keys', 'ca3-cert.pem'),
+];
+fs.copyFileSync(expectedCertFiles[1], path.join(firstCertDir, 'ca2-cert.pem'));
+fs.copyFileSync(expectedCertFiles[2], path.join(secondCertDir, 'ca3-cert.pem'));
+
+spawnSyncAndExitWithoutError(
+  process.execPath,
+  ['--use-openssl-ca', fixtures.path('tls-check-openssl-ca-certificates.js')],
+  {
+    env: {
+      ...process.env,
+      EXPECTED_CERT_FILES: JSON.stringify(expectedCertFiles),
+      NODE_EXTRA_CA_CERTS: undefined,
+      SSL_CERT_FILE: expectedCertFiles[0],
+      SSL_CERT_DIR: [firstCertDir, secondCertDir].join(path.delimiter),
+    },
+  },
+);

typings/internalBinding/crypto.d.ts

@@ -933,6 +933,7 @@ export interface CryptoBinding {
   getFipsCrypto(): 0 | 1;
   getHashes(): string[];
   getKeyObjectSlots(key: object): InternalCryptoBinding.KeyObjectSlots;
+  getOpenSSLCACertificates(): string[];
   getOpenSSLSecLevelCrypto(): number | undefined;
   getSSLCiphers(): string[];
   getSystemCACertificates(): string[];