`tls.getCACertificates("default")` always returns an empty list when using `--use-openssl-ca`

Version

v26.4.0

Platform

Linux jvm1 6.17.0-1025-oem #25-Ubuntu SMP PREEMPT_DYNAMIC Fri May 29 12:11:29 UTC 2026 x86_64 GNU/Linux

Subsystem

tls

What steps will reproduce the bug?

1. Run NODE_OPTIONS="--use-openssl-ca" node -e 'console.log("Default certificates:", tls.getCACertificates("default")); fetch("https://example.org").then(rsp => console.log("HTTP status code:", rsp.status));'

Its output (provided your default OpenSSL certs are fairly standard) will be:

Default certificates: []
HTTP status code: 200

As can be seen, the request to https://example.org succeeds despite us having no default certificates according to tls.getCACertificates("default")

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

I would expect tls.getCACertificates("default") to return the certificates provided by OpenSSL that NodeJS uses to verify the certificate chain. I expect this since the documentation for the "default" type in tls.getCACertificates states: "return the CA certificates that will be used by the Node.js TLS clients by default".

What do you see instead?

An empty array

Additional information

Invoking tls.setDefaultCACertificates([]) and fetching https://example.org afterwards does cause UNABLE_TO_GET_ISSUER_CERT_LOCALLY

Commencez par exécuter la reproduction signalée NODE_OPTIONS="--use-openssl-ca" et inspectez le point d’entrée tls.getCACertificates("default") dans le sous-système tls. Comparez son résultat avec les certificats utilisés par fetch et avec le comportement après tls.setDefaultCACertificates([]). Le travail est terminé lorsque la liste par défaut reflète les certificats OpenSSL utilisés pour la vérification et que la reproduction est couverte par des tests.