mirrors/nodejs
mirrors/nodejs
0
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-24 20:29:23 +01:00
Code Issues Releases Activity

crypto: Use system CAs instead of using bundled ones

Browse Source 
NodeJS can already use an external, shared OpenSSL library. This
library knows where to look for OS managed certificates. Allow
a compile-time option to use this CA store by default instead of
using bundled certificates.

In case when using bundled OpenSSL, the paths are also valid for
majority of Linux systems without additional intervention. If
this is not set, we can use SSL_CERT_DIR to point it to correct
location.

Fixes: https://github.com/nodejs/node/issues/3159
PR-URL: https://github.com/nodejs/node/pull/8334
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
This commit is contained in:
Adam Majer 2016-12-21 11:16:38 +01:00 committed by Sam Roberts
parent 3ada5ae641
commit 3aa17e4e51
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
configure vendored
View File

@ -144,6 +144,11 @@ parser.add_option('--openssl-fips',
dest='openssl_fips', dest='openssl_fips',
help='Build OpenSSL using FIPS canister .o file in supplied folder') help='Build OpenSSL using FIPS canister .o file in supplied folder')
parser.add_option('--openssl-use-def-ca-store',
action='store_true',
dest='use_openssl_ca_store',
help='Use OpenSSL supplied CA store instead of compiled-in Mozilla CA copy.')
shared_optgroup.add_option('--shared-http-parser', shared_optgroup.add_option('--shared-http-parser',
action='store_true', action='store_true',
dest='shared_http_parser', dest='shared_http_parser',
@ -940,6 +945,8 @@ def configure_openssl(o):
o['variables']['node_use_openssl'] = b(not options.without_ssl) o['variables']['node_use_openssl'] = b(not options.without_ssl)
o['variables']['node_shared_openssl'] = b(options.shared_openssl) o['variables']['node_shared_openssl'] = b(options.shared_openssl)
o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0 o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0
if options.use_openssl_ca_store:
o['defines'] += ['NODE_OPENSSL_CERT_STORE']
if options.openssl_fips: if options.openssl_fips:
o['variables']['openssl_fips'] = options.openssl_fips o['variables']['openssl_fips'] = options.openssl_fips
fips_dir = os.path.join(root_dir, 'deps', 'openssl', 'fips') fips_dir = os.path.join(root_dir, 'deps', 'openssl', 'fips')

4
src/node_crypto.cc
View File

@ -707,10 +707,14 @@ static X509_STORE* NewRootCertStore() {
} }
X509_STORE* store = X509_STORE_new(); X509_STORE* store = X509_STORE_new();
#if defined(NODE_OPENSSL_CERT_STORE)
X509_STORE_set_default_paths(store);
#else
for (X509 *cert : root_certs_vector) { for (X509 *cert : root_certs_vector) {
X509_up_ref(cert); X509_up_ref(cert);
X509_STORE_add_cert(store, cert); X509_STORE_add_cert(store, cert);
} }
#endif
return store; return store;
} }