crypto: allow adding extra certs to well-known CAs #9139

sam-github · 2016-10-17T19:35:25Z

Checklist

make -j8 test (UNIX), or vcbuild test nosign (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

Affected core subsystem(s)

crypto,tls,https

Description of change

In closed environments, self-signed or privately signed certificates are
commonly used, and rejected by Node.js since their root CAs are not
well-known. Allow extending the set of well-known compiled-in CAs via
environment, so they can be set as a matter of policy.

Note that #8334 addresses a similar but not identical use-case, and works better for those (like linux distributions) that are willing to recompile Node.js to use OpenSSL's default certificate store. #8334
doesn't address those who cannot recompile, do not have access to the system certificate store, or
who are are on a system where the default certificate store is not exposed as an OpenSSL compatible
store (for example, OS X and Windows).

See #3159, #8334

Partially fixes #4175 (particularly #4175 (comment)), and may also address microsoft/tfs-cli#118 and apigee/microgateway-core#9 without forcing them to recompile node.

mscdex · 2016-10-17T21:17:44Z

test/parallel/test-tls-env-extra-ca.js

+const server = tls.createServer(options, function(s) {
+  s.end('bye');
+}).listen(0)
+.on('listening', function() {


This function can be passed as a second argument to listen() to make things shorter.

Also, you might wrap it in a common.mustCall() to be extra safe.

mscdex · 2016-10-17T21:20:45Z

test/parallel/test-tls-env-extra-ca.js

+.on('listening', function() {
+  process.env.CHILD = 'yes';
+  process.env.PORT = this.address().port;
+  process.env.NODE_EXTRA_CA_CERTS = common.fixturesDir + '/keys/ca1-cert.pem';


It would be better to instead set these variables in the config object passed to fork():

const env = { CHILD: 'yes', PORT: this.address().port, NODE_EXTRA_CA_CERTS: common.fixturesDir + '/keys/ca1-cert.pem' }; fork(__filename, { env: env }).on('exit', common.mustCall(function(status) {

mscdex · 2016-10-17T21:23:03Z

src/node_crypto.cc

+    ERR_clear_error();
+  } else if (err) {
+    fprintf(stderr, "Ignoring extra certs from `%s`, load failed: %s\n",
+        extra_root_certs_file, ERR_error_string(err, NULL));


This should be indented more to align with the other function arguments.

mscdex · 2016-10-17T21:23:28Z

src/node_crypto.cc

+  unsigned long err = ERR_peek_error();  // NOLINT(runtime/int)
+  // Clear error if its EOF/no start line found.
+  if (ERR_GET_LIB(err) == ERR_LIB_PEM
+      && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {


&& should be at end of the previous line.

mscdex · 2016-10-17T21:23:53Z

src/node_crypto.cc

+  if (!bio) {
+    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+    fprintf(stderr, "Ignoring extra certs from `%s`, load failed: %s\n",
+        extra_root_certs_file, ERR_error_string(err, NULL));


This should be indented more to align with the other function arguments.

mscdex · 2016-10-17T21:24:37Z

doc/api/cli.md

@@ -298,6 +298,15 @@ asynchronous when outputting to a TTY on platforms which support async stdio.
 Setting this will void any guarantee that stdio will not be interleaved or
 dropped at program exit. **Use of this mode is not recommended.**

+### `NODE_EXTRA_CA_CERTS=file`
+
+When set, the  well known "root" CAs (like VeriSign) will be extended with the


There's an extra space between 'the' and 'well'.

mscdex · 2016-10-17T21:24:58Z

doc/api/cli.md

+
+When set, the  well known "root" CAs (like VeriSign) will be extended with the
+exta certificates in `file`. The file should consist of one or more trusted
+certificates in PEM format.  A message will be printed (once) if the file is


There's an extra space before 'A message'.

mscdex · 2016-10-17T21:29:47Z

I think the fprintf()s should be replaced with a call to process.emitWarning(). I'm not sure if there is already something in node internals that only emits a warning once that could be reused.

bnoordhuis · 2016-10-18T14:09:09Z

doc/api/cli.md

+### `NODE_EXTRA_CA_CERTS=file`
+
+When set, the  well known "root" CAs (like VeriSign) will be extended with the
+exta certificates in `file`. The file should consist of one or more trusted


Typo: extra

sam-github · 2016-10-18T15:33:00Z

I'll look around to see if I can call process.emitWarning() from C++.

Note that there is a pre-existing fprintf(stderr, ... statement at

node/src/node_crypto.cc

Line 5788 in 7014566

fprintf(stderr, "openssl fips failed: %s\n", ERR_error_string(err, NULL));

, should it be emitWarning, too?

mscdex · 2016-10-18T15:36:26Z

@sam-github No, because that's a more fatal error and the process will abort after it prints that message.

sam-github · 2016-10-18T20:31:14Z

@mscdex @bnoordhuis Now calling process.emitWarning(), PTAL

Also, a design detail: currently, the value of the NODE_EXTRA_CA_CERTS is retrieved from env during node startup. So, this doesn't work as maybe someone would hope:

process.env.NODE_EXTRA_CA_CERTS = "cacerts.pem";
require('tls').createServer({}) // ... no extra are loaded

It would be possible to call secure_getenv() during the root store initialization to enable the above usage.

But, I think how it is now is consistent with general node practice, and that anyone who can edit the program source could also just provide the extra CA certs themselves via the options.

Agreed?

sam-github · 2016-10-18T20:32:31Z

If the call to emitWarning() from c++ is OK, I will update the docs and add a unit test.

mscdex · 2016-10-18T20:38:42Z

test/parallel/test-tls-env-extra-ca.js

+    assert.equal(status, 0, 'client did not succeed in connecting');
+  }));
+
+  server.unref();


Is this necessary? What about just calling server.close() inside the server's connection handler?

I don't really mind, though I don't see how that is preferable. unref allows node to close gracefully when it has nothing else to do, closing would also have the same effect, why is it better?

mscdex · 2016-10-18T20:43:47Z

src/node_crypto.cc

+    node::OneByteString(env->isolate(), warning, strlen(warning))
+  };
+
+  f.As<v8::Function>()->Call(process, arraysize(args), args);


It might be better to use MakeCallback() here instead of calling it directly.

@mscdex, for my benefit when would you suggest MakeCallback instead of Call or vice versa. I see that existing code has a mix of both.

I assume MakeCallback() should almost always be used because of domains/async_hooks and such?

I did find this more detailed discussion on the topic from a while back: nodejs/nan#284. I think the net is that unless you have a specific reason that you don't want process._tickCallback() to be called, then MakeCallback() is preferred over the direct Call.

@mhdawson 's link above says

The latter (MakeCallback) case calls the JS callback function, but then also ends the current tick, calling process._tickCallback() and any other callbacks registered via nextTick(). This form is intended only for use by C++ code that was dispatched from the libuv event loop, and not for C++ code that was invoked from JS code.

It sounds like MakeCallback() has lots of side effects, are you sure its right? My usage seems to fit the "not C++ invoked from the event loop" case.

It occured to me that process.emitWarning() could actually emit... which would call user code, but I checked, and it emits in the next tick, so isn't going to hit any user-supplied js.

I don't know enough about the distinction to choose, I'll need some guidance here.

@bnoordhuis do you have an opinion on Call/MakeCallback in this instance ?

@trevnorris I think that MakeCallback can cause running microtasks as a side-effect (

node/src/node.cc

Line 1268 in 09d41e2

env->isolate()->RunMicrotasks();

), which would not be desireable, but I'm not sure how to demonstrate this. Trevor, you know this code, should usage like above use direct Call(), or node::MakeCallback()?

My failed attempt at making a "microtask" :-( at https://gist.github.com/927a451526de55847d53694b53b01a20

mhdawson · 2016-10-18T21:56:02Z

LGTM subject to fixing up @mscdex remaining comments.

sam-github · 2016-10-19T18:22:15Z

conversation in #9139 (comment) looks outdated because I added MakeCallback(), but it is not outdated. /to @bnoordhuis @trevnorris

bnoordhuis · 2016-10-20T11:10:34Z

src/node_crypto.cc

@@ -120,6 +120,8 @@ const char* const root_certs[] = {
 #include "node_root_certs.h"  // NOLINT(build/include_order)
 };

+const char* extra_root_certs_file;


Should be static.

done, note that root_certs a few lines above is not static, but appears that it could be (I was mirroring its definition). root_cert_store below is explicitly declared extern, it shouldn't be static.

bnoordhuis · 2016-10-20T11:11:05Z

src/node_crypto.cc

+  extra_root_certs_file = fname;
+}
+
+static void emitWarning(Environment* env, const char* fmt, ...) {


EmitWarning

bnoordhuis · 2016-10-20T11:11:21Z

src/node_crypto.cc

+  vsnprintf(warning, sizeof(warning), fmt, ap);
+  va_end(ap);
+
+#if 0


Don't leave dead code in.

Its not dead code. I am asking for confirmation that MakeCallbacks() is the right thing to do, I believe the #if 0 branch is the correct one, and that MakeCallbacks() is designed for callbacks from uv, and other async usage, not for this kind of direct js-to-c++-to-js usage. That it is leaking handles and running microtasks make it seem the wrong tool. @trevnorris @bnoordhuis Shouldn't this be a simple Call()?

Call() interacts poorly with domains and other mechanisms that hang off async_hooks so it's really only safe for internal JS code. W.r.t. handle leaks, Call does that as well (the return value.)

@bnoordhuis what is "internal JS code"? In this case I am calling

node/lib/internal/process/warning.js

Lines 28 to 49 in 6845d6e

process.emitWarning = function(warning, name, ctor) {

if (typeof name === 'function') {

ctor = name;

name = 'Warning';

}

if (warning === undefined || typeof warning === 'string') {

warning = new Error(warning);

warning.name = name || 'Warning';

Error.captureStackTrace(warning, ctor || process.emitWarning);

}

if (!(warning instanceof Error)) {

throw new TypeError('\'warning\' must be an Error object or string.');

}

if (warning.name === 'DeprecationWarning') {

if (process.noDeprecation)

return;

if (process.throwDeprecation)

throw warning;

}

process.nextTick(() => process.emit('warning', warning));

};

}

, which is internal. It does nextTick a process.emit(), which can call user-code. Is that the difference here? That user code (process.on('warning', user....) was triggered from within createServer(), so we need to use MakeCallback() to keep the accounting correct for domains, etc.?

Otherwise, this doesn't seem so different from url.js, which calls into c++ to do some work, and synchronously calls back with ->Call() to internal js code. Or node_http_parser, which uses Call() to call pushValueToArray(), a js function from lib/internal/bootstrap_node.js

I (and @mhdawson , perhaps others), would like to understand the basic principle here, so I correctly distinguish between the two in the future.

Also, with MakeCallback():

require("tls").createServer() // -> MakeCallback // -> process.emitWarning() // -> env->isolate()->RunMicrotasks() // -> env->tick_callback_function()->Call() // return from createServer()

How would I demonstrate that createServer(), when it uses MakeCallback(), is causing micro tasks and ticks to get called? Or do they not? I'm trying to see what the side-effects are, but couldn't prove there were any with https://gist.github.com/sam-github/927a451526de55847d53694b53b01a20 (I was looking to cause output between the BEGIN and END, which should not happen).

I addressed your other comments, thanks, and I will fix the handle leak, looking into that now.

Oh, that's a good point; I didn't realize emitWarning() defers to the next tick. In that case Call() should be fine.

bnoordhuis · 2016-10-20T11:12:24Z

src/node_crypto.cc

+#else
+  Local<Object> process = env->process_object();
+  Local<Value> args[] = {
+    node::OneByteString(env->isolate(), warning, strlen(warning))


You can leave out the strlen().

Oh, and you could write this as:

Local<Value> arg = node::OneByteString(env->isolate(), warning); MakeCallback(env, process, "emitWarning", 1, &arg);

It's a little more succinct but whatever you prefer.

I did used the array form because I had the impression it was more idiomatic, but I simplified the code as you suggest.

bnoordhuis · 2016-10-20T11:17:46Z

src/node_crypto.cc

+  };
+  MakeCallback(env, process, "emitWarning", arraysize(args), args);
+#endif
+}


This function needs a HandleScope, it's leaking handles into the scope of the caller.

bnoordhuis · 2016-10-20T11:18:01Z

src/node_crypto.cc

+  if (!bio) {
+    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+    emitWarning(env, "Ignoring extra certs from `%s`, load failed: %s\n",
+            extra_root_certs_file, ERR_error_string(err, NULL));


Arguments should line up here and below.

bnoordhuis · 2016-10-20T11:18:58Z

src/node_crypto.cc

+  if (!extra_root_certs_file)
+    return;
+
+  BIO *bio = BIO_new_file(extra_root_certs_file, "r");


Style: BIO* bio = ...

bnoordhuis · 2016-10-20T11:23:20Z

src/node_crypto.cc

+    emitWarning(env, "Ignoring extra certs from `%s`, load failed: %s\n",
+            extra_root_certs_file, ERR_error_string(err, NULL));
+  }
+}


This function could share code with SSL_CTX_use_certificate_chain. Also, you could add a MarkPopErrorOnReturn mark_pop_error_on_return at the top so you don't have to manually juggle the error stack.

bnoordhuis · 2016-10-20T11:26:44Z

src/node_crypto.cc

@@ -770,6 +830,8 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
      BIO_free_all(bp);
      X509_free(x509);
    }
+
+    LoadExtraCaCerts(Environment::GetCurrent(args));


You could use sc->env() here instead.

bnoordhuis · 2016-10-20T11:31:06Z

src/node_crypto.h

@@ -76,6 +76,8 @@ class SecureContext : public BaseObject {

  static void Initialize(Environment* env, v8::Local<v8::Object> target);

+  static void UseExtraCaCerts(const char* file);


It's kind of odd that this is a (static) method but LoadExtraCaCerts() is not. Neither manipulate SecureContext state so they probably shouldn't be methods, static or not.

bnoordhuis · 2016-10-20T11:38:27Z

I have a feeling we can move much of the logic to JS land if we simply exposed the root CA list somewhere.

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

In closed environments, self-signed or privately signed certificates are commonly used, and rejected by Node.js since their root CAs are not well-known. Allow extending the set of well-known compiled-in CAs via environment, so they can be set as a matter of policy. PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

In closed environments, self-signed or privately signed certificates are commonly used, and rejected by Node.js since their root CAs are not well-known. Allow extending the set of well-known compiled-in CAs via environment, so they can be set as a matter of policy. PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

In closed environments, self-signed or privately signed certificates are commonly used, and rejected by Node.js since their root CAs are not well-known. Allow extending the set of well-known compiled-in CAs via environment, so they can be set as a matter of policy. PR-URL: nodejs#9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

In closed environments, self-signed or privately signed certificates are commonly used, and rejected by Node.js since their root CAs are not well-known. Allow extending the set of well-known compiled-in CAs via environment, so they can be set as a matter of policy. PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

Notable Changes: * child_process: add shell option to spawn() (cjihrig) #4598 * crypto: * add ALPN Support (Shigeki Ohtsu) #2564 * allow adding extra certs to well-known CAs (Sam Roberts) #9139 * deps: * v8: expose statistics about heap spaces (Ben Ripkens) #4463 * fs: add the fs.mkdtemp() function. (Florian MARGAINE) #5333 * process: * add `externalMemory` to `process` (Fedor Indutny) #9587 * add process.cpuUsage() (Patrick Mueller) #10796

Notable Changes: The SEMVER-MINOR changes include: * crypto: allow adding extra certs to well-known CAs (Sam Roberts) #9139 * deps: Upgrade INTL ICU to version 58 (Steven R. Loomis) #9234 * process: add `process.memoryUsage.external` (Fedor Indutny) #9587 * src: add wrapper for process.emitWarning() (Sam Roberts) #9139 Notable SEMVER-PATCH changes include: * fs: cache non-symlinks in realpathSync. (Jeremy Yallop) #10253 * repl: allow autocompletion for scoped packages (Evan Lucas) #10296

Notable Changes: * child_process: add shell option to spawn() (cjihrig) #4598 * crypto: * add ALPN Support (Shigeki Ohtsu) #2564 * allow adding extra certs to well-known CAs (Sam Roberts) #9139 * deps: * v8: expose statistics about heap spaces (Ben Ripkens) #4463 * fs: add the fs.mkdtemp() function. (Florian MARGAINE) #5333 * process: * add `externalMemory` to `process` (Fedor Indutny) #9587 * add process.cpuUsage() (Patrick Mueller) #10796 PR-URL: #10973

Notable Changes: The SEMVER-MINOR changes include: * crypto: allow adding extra certs to well-known CAs (Sam Roberts) #9139 * deps: Upgrade INTL ICU to version 58 (Steven R. Loomis) #9234 * process: add `process.memoryUsage.external` (Fedor Indutny) #9587 * src: add wrapper for process.emitWarning() (Sam Roberts) #9139 Notable SEMVER-PATCH changes include: * fs: cache non-symlinks in realpathSync. (Jeremy Yallop) #10253 * repl: allow autocompletion for scoped packages (Evan Lucas) #10296 PR-URL: #10974

Notable Changes: * child_process: add shell option to spawn() (cjihrig) nodejs/node#4598 * crypto: * add ALPN Support (Shigeki Ohtsu) nodejs/node#2564 * allow adding extra certs to well-known CAs (Sam Roberts) nodejs/node#9139 * deps: * v8: expose statistics about heap spaces (Ben Ripkens) nodejs/node#4463 * fs: add the fs.mkdtemp() function. (Florian MARGAINE) nodejs/node#5333 * process: * add `externalMemory` to `process` (Fedor Indutny) nodejs/node#9587 * add process.cpuUsage() (Patrick Mueller) nodejs/node#10796 Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

Notable Changes: The SEMVER-MINOR changes include: * crypto: allow adding extra certs to well-known CAs (Sam Roberts) nodejs/node#9139 * deps: Upgrade INTL ICU to version 58 (Steven R. Loomis) nodejs/node#9234 * process: add `process.memoryUsage.external` (Fedor Indutny) nodejs/node#9587 * src: add wrapper for process.emitWarning() (Sam Roberts) nodejs/node#9139 Notable SEMVER-PATCH changes include: * fs: cache non-symlinks in realpathSync. (Jeremy Yallop) nodejs/node#10253 * repl: allow autocompletion for scoped packages (Evan Lucas) nodejs/node#10296 Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

Notable Changes: * child_process: add shell option to spawn() (cjihrig) nodejs/node#4598 * crypto: * add ALPN Support (Shigeki Ohtsu) nodejs/node#2564 * allow adding extra certs to well-known CAs (Sam Roberts) nodejs/node#9139 * deps: * v8: expose statistics about heap spaces (Ben Ripkens) nodejs/node#4463 * fs: add the fs.mkdtemp() function. (Florian MARGAINE) nodejs/node#5333 * process: * add `externalMemory` to `process` (Fedor Indutny) nodejs/node#9587 * add process.cpuUsage() (Patrick Mueller) nodejs/node#10796 Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

Notable Changes: The SEMVER-MINOR changes include: * crypto: allow adding extra certs to well-known CAs (Sam Roberts) nodejs/node#9139 * deps: Upgrade INTL ICU to version 58 (Steven R. Loomis) nodejs/node#9234 * process: add `process.memoryUsage.external` (Fedor Indutny) nodejs/node#9587 * src: add wrapper for process.emitWarning() (Sam Roberts) nodejs/node#9139 Notable SEMVER-PATCH changes include: * fs: cache non-symlinks in realpathSync. (Jeremy Yallop) nodejs/node#10253 * repl: allow autocompletion for scoped packages (Evan Lucas) nodejs/node#10296 Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

nodejs-github-bot added the c++ Issues and PRs that require attention from people who are familiar with C++. label Oct 17, 2016

sam-github added tls Issues and PRs related to the tls subsystem. crypto Issues and PRs related to the crypto subsystem. https Issues or PRs related to the https subsystem. labels Oct 17, 2016

mscdex reviewed Oct 17, 2016

View reviewed changes

mscdex removed crypto Issues and PRs related to the crypto subsystem. https Issues or PRs related to the https subsystem. labels Oct 17, 2016

bnoordhuis reviewed Oct 18, 2016

View reviewed changes

sam-github force-pushed the extendable-ca-certs branch from a691889 to 87e2514 Compare October 18, 2016 15:28

rvagg force-pushed the master branch 2 times, most recently from c133999 to 83c7a88 Compare October 18, 2016 17:02

mscdex reviewed Oct 18, 2016

View reviewed changes

sam-github force-pushed the extendable-ca-certs branch 2 times, most recently from 648a62d to 6c50346 Compare October 19, 2016 18:24

bnoordhuis requested changes Oct 20, 2016

View reviewed changes

MylesBorins added land-on-v6.x and removed dont-land-on-v6.x labels Jan 24, 2017

MylesBorins pushed a commit that referenced this pull request Jan 24, 2017

src: add wrapper for process.emitWarning()

377e14e

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

MylesBorins pushed a commit that referenced this pull request Jan 24, 2017

src: add wrapper for process.emitWarning()

2e02957

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

MylesBorins mentioned this pull request Jan 24, 2017

v6.10.0 proposal #10974

Merged

MylesBorins pushed a commit that referenced this pull request Jan 31, 2017

src: add wrapper for process.emitWarning()

5e07bce

PR-URL: #9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

MylesBorins mentioned this pull request Feb 6, 2017

v4.8.0 proposal #10973

Merged

jefft mentioned this pull request Feb 10, 2017

Handle insecure SSL warnings when connecting to JIRA servers johannesjo/super-productivity#5

Closed

sam-github removed the dont-land-on-v4.x label Feb 27, 2017

kmkaplan mentioned this pull request Jan 11, 2018

unable to check site, maybe letsencrypt cert related keybase/keybase-issues#1950

Closed

Jacksondr5 mentioned this pull request Sep 27, 2019

Consider Certs In NODE_EXTRA_CA_CERTS microsoft/typed-rest-client#166

Closed

Freyert mentioned this pull request Sep 30, 2021

'Certificate has expired' error for Let's Encrypt certificates (DST Root CA X3 issued) postmanlabs/postman-app-support#10338

Closed

1 task

	process.emitWarning = function(warning, name, ctor) {
	if (typeof name === 'function') {
	ctor = name;
	name = 'Warning';
	}
	if (warning === undefined \|\| typeof warning === 'string') {
	warning = new Error(warning);
	warning.name = name \|\| 'Warning';
	Error.captureStackTrace(warning, ctor \|\| process.emitWarning);
	}
	if (!(warning instanceof Error)) {
	throw new TypeError('\'warning\' must be an Error object or string.');
	}
	if (warning.name === 'DeprecationWarning') {
	if (process.noDeprecation)
	return;
	if (process.throwDeprecation)
	throw warning;
	}
	process.nextTick(() => process.emit('warning', warning));
	};
	}

		@@ -76,6 +76,8 @@ class SecureContext : public BaseObject {

		static void Initialize(Environment* env, v8::Local<v8::Object> target);

		static void UseExtraCaCerts(const char* file);

crypto: allow adding extra certs to well-known CAs #9139

crypto: allow adding extra certs to well-known CAs #9139

Conversation

sam-github commented Oct 17, 2016

Checklist

Affected core subsystem(s)

Description of change

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mscdex Oct 17, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mscdex commented Oct 17, 2016 • edited Loading

Choose a reason for hiding this comment

sam-github commented Oct 18, 2016

mscdex commented Oct 18, 2016

sam-github commented Oct 18, 2016

sam-github commented Oct 18, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mscdex Oct 18, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Oct 18, 2016

sam-github commented Oct 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sam-github Oct 20, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bnoordhuis commented Oct 20, 2016

mscdex Oct 17, 2016 •

edited

Loading

mscdex commented Oct 17, 2016 •

edited

Loading

mscdex Oct 18, 2016 •

edited

Loading

sam-github Oct 20, 2016 •

edited

Loading