nodejs / nodejs/node

--use-system-ca fails to start with bad OPENSSL_CONF set

Open
#63,256 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
122k
Forks
37.3k
Avg merge
4d 2h
Merged PRs (30d)
283

Description

Version

26.1.0 (also seen with 22.22.2)

Platform
Microsoft Windows NT 10.0.26200.0 x64

Only windows has been tested
Subsystem

No response

What steps will reproduce the bug?

In powershell

$env:OPENSSL_CONF="c:"
node --use-system-ca
How often does it reproduce? Is there a required condition?

This happens consistently when there is a bad OPENSSL_CONF variable set

What is the expected behavior? Why is that the expected behavior?

I would expect it to fail to load some certificates/configs, but succeed with the good items in the variables and launch correctly.

What do you see instead?
PS C:\Users\farad> $env:OPENSSL_CONF="c:"
PS C:\Users\farad> node --use-system-ca
C:\Users\farad\AppData\Local\fnm_multishells\11396_1778525811252\node.exe: OpenSSL configuration error:
44190000:error:80000005:system library:BIO_new_file:Input/output error:openssl\crypto\bio\bss_file.c:67:calling fopen(c:, rb)

And node exits

Additional information

Related #58990

I can appreciate this may be openssl behaviour that cannot be controlled.

In our application we are using nodejs binaries to spawn some child processes. We want to set this flag to make the use of corporate deployed certificates easier, but have encountered an application which sets OPENSSL_CONF to a directory and causes node to fail to start.

This also appears to affect binaries built with @yao/pkg

I have checked that this is not unique to being installed through fnm

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Windows PowerShell command with OPENSSL_CONF set to "c:" and --use-system-ca. The report names no source file or test entry point; trace Node's startup handling of these options and verify that an invalid configuration path no longer prevents launch while certificate loading still works for valid settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.