spkac exportPublicKey cannot distinguish between internal failure vs invalid input

Version

v25.9.0

Platform

Linux 749dbb0e74fd 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar  6 07:58:08 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

crypto

What steps will reproduce the bug?

The following code will serve as an example to sketch the scenario:

const { Certificate } = require('crypto');
const spkacString = '...';
console.log(Certificate.exportPublicKey(spkacString));

This will hit the following code path, causing an empty string to be returned:

https://github.com/nodejs/node/blob/349d22625713f94a5cc667592bbf34cd63af36e6/src/crypto/crypto_spkac.cc#L43-L44

Note that in the case of a valid spkac but with an internal OpenSSL failure (e.g. allocation failure), it behaves the same as an invalid spkac string. This makes distinguishing between an invalid spkac and an internal failure conditions not possible at the call site.
Furthermore, returning an empty string seems inconsistent with how other similar APIs work, e.g.:

https://github.com/nodejs/node/blob/349d22625713f94a5cc667592bbf34cd63af36e6/src/crypto/crypto_keys.cc#L141-L143

How often does it reproduce? Is there a required condition?

When an allocation failure happens or unspecified other type of failure happens inside OpenSSL, it will reproduce.

What is the expected behavior? Why is that the expected behavior?

I would expect an exception at least in the case of an internal OpenSSL failure. Besides that, it's unexpected that there's an inconsistency in the API design between different export functions. I'd expect the failure handling to be done in a consistent manner.

What do you see instead?

An empty string is returned. At least something to distinguish invalid spkac vs internal failure would be welcome.

Additional information

Found by an experimental static-hybrid analyzer I'm working on.

Bắt đầu tại src/crypto/crypto_spkac.cc, quanh dòng 43-44, và so sánh cách xử lý lỗi với src/crypto/crypto_keys.cc, quanh dòng 141-143. Theo dõi Certificate.exportPublicKey và xác định input SPKAC không hợp lệ khác với lỗi nội bộ của OpenSSL như thế nào. Hoàn thành khi có thể phân biệt các kết quả đó và hành vi được bao phủ bởi các crypto test phù hợp.