Commit ca39540
doc: clarify --use-system-ca support status
Node.js only checks trust settings of additional certificates
from the system store.
It does not, however, support revocation/distrust of existing
certificates.
PR-URL: #60340
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 12e9213 commit ca39540
1 file changed
Lines changed: 10 additions & 10 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3142,21 +3142,18 @@ On platforms other than Windows and macOS, this loads certificates from the dire | |||
| 3142 | 3142 | and file trusted by OpenSSL, similar to `--use-openssl-ca`, with the difference being | |
| 3143 | 3143 | that it caches the certificates after first load. | |
| 3144 | 3144 | ||
| 3145 | - On Windows and macOS, the certificate trust policy is planned to follow | ||
| 3146 | - [Chromium's policy for locally trusted certificates][]: | ||
| 3145 | + On Windows and macOS, the certificate trust policy is similar to | ||
| 3146 | + [Chromium's policy for locally trusted certificates][], but with some differences: | ||
| 3147 | 3147 | ||
| 3148 | 3148 | On macOS, the following settings are respected: | |
| 3149 | 3149 | ||
| 3150 | 3150 | * Default and System Keychains | |
| 3151 | 3151 | * Trust: | |
| 3152 | 3152 | * Any certificate where the “When using this certificate” flag is set to “Always Trust” or | |
| 3153 | - * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust.” | ||
| 3154 | - * Distrust: | ||
| 3155 | - * Any certificate where the “When using this certificate” flag is set to “Never Trust” or | ||
| 3156 | - * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Never Trust.” | ||
| 3153 | + * Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust”. | ||
| 3154 | + * The certificate must also be valid, with "X.509 Basic Policy" set to “Always Trust”. | ||
| 3157 | 3155 | ||
| 3158 | - On Windows, the following settings are respected (unlike Chromium's policy, distrust | ||
| 3159 | - and intermediate CA are not currently supported): | ||
| 3156 | + On Windows, the following settings are respected: | ||
| 3160 | 3157 | ||
| 3161 | 3158 | * Local Machine (accessed via `certlm.msc`) | |
| 3162 | 3159 | * Trust: | |
@@ -3171,8 +3168,11 @@ and intermediate CA are not currently supported): | |||
| 3171 | 3168 | * Trusted Root Certification Authorities | |
| 3172 | 3169 | * Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities | |
| 3173 | 3170 | ||
| 3174 | - On Windows and macOS, Node.js would check that the user settings for the certificates | ||
| 3175 | - do not forbid them for TLS server authentication before using them. | ||
| 3171 | + On Windows and macOS, Node.js would check that the user settings for the trusted | ||
| 3172 | + certificates do not forbid them for TLS server authentication before using them. | ||
| 3173 | + | ||
| 3174 | + Node.js currently does not support distrust/revocation of certificates | ||
| 3175 | + from another source based on system settings. | ||
| 3176 | 3176 | ||
| 3177 | 3177 | On other systems, Node.js loads certificates from the default certificate file | |
| 3178 | 3178 | (typically `/etc/ssl/cert.pem`) and default certificate directory (typically | |
0 commit comments