[RRFC] Separate ca npm config based on scope

Motivation ("The Why")

When working with multiple registries that use https, it quickly becomes hard to manage the SSL certificates.

Example

Allow people to easily manage their certificate configurations through .npmrc so they can commit those files and share them, rather than rely on the enclosing environment to be already set up.

How

Separate ca/cafile npm configurations based on scope.

Current Behaviour

Many online examples state to just run npm config set cafile <file-path-to-X509-cert>. But then after doing this npm will no longer trust connections to https://npmjs.org since the cafile has been overwritten.

The next highest solution is to use the Node environment variable “NODE_EXTRA_CA_CERTS” to set that to the file path for your X509 certificate.
This is a step in the right direction in some ways, but if you want to have more than 1 more registry with a different CA then you have to start concatenating to that certificate file.
In order to install the dependent packages now your environment has to be altered rather heavily.
This is an impediment for new contributors and adds extra scripted steps to prepare CI jobs.

One thing that works currently is specifying a ca string in a .npmrc file or in the config section of a package.json.
ca="-----BEGIN CERTIFICATE-----xxxxxxxxx\nxxxxxxxxxxxx\nxxxxxxxxxxxx\nxxxxxxxxx\n-----END CERTIFICATE-----"

This helps move the relevant trusted certificate next to the registry configuration so you can better associate them with each other. But it still does not help with having multiple ca certificates for different registries. Is is set once and npm tries to use that certificate for all registries and all commands within the folder that contains the .npmrc file.

Desired Behaviour

In .npmrc and package.json if we could have scoped ca configurations then we could separate ca certificates such that each registry could have its own associated certificate.

Like this

@myScope:registry=https://example.com/npm
@myScope:ca="-----BEGIN CERTIFICATE-----xxxxxxxxx\nxxxxxxxxxxxx\nxxxxxxxxxxxx\nxxxxxxxxx\n-----END CERTIFICATE-----"

References

https://docs.npmjs.com/cli/v7/using-npm/config#ca
https://stackoverflow.com/a/27997570/4262466

Start with the npm configuration documentation for ca and compare how .npmrc and package.json currently represent registry and certificate settings. Define the expected scoped configuration behavior for multiple HTTPS registries, including how existing unscoped settings behave, and document completion as a reviewed RFC with clear configuration examples.