Repository navigation
src: honor NODE_EXTRA_CA_CERTS set in an env file - #66638
Open
marcopiraccini wants to merge 2 commits into
Open
marcopiraccini wants to merge 2 commits into
marcopiraccini wants to merge 2 commits into
Conversation
NODE_EXTRA_CA_CERTS is read once at startup, before the files passed with --env-file are applied to the environment. A value set in an env file showed up in process.env but the certificates were never loaded. Look the variable up in the parsed env files when it is not in the environment. The environment keeps precedence, and the env files are ignored under the same conditions as the environment: when node runs setuid, setgid or with Linux file capabilities. Fixes: nodejs#51426 Refs: nodejs#51497 Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
marcopiraccini
marked this pull request as ready for review
October 10, 2026 08:15
ShogunPanda
reviewed
Oct 10, 2026
| added: v7.3.0 | ||
| changes: | ||
| - version: REPLACEME | ||
| pr-url: https://github.com/nodejs/node/pull/00000 |
Contributor
There was a problem hiding this comment.
Nit: replace this. But not blocking.
ShogunPanda
approved these changes
Oct 10, 2026
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #66638 +/- ##
==========================================
- Coverage 92.78% 90.43% -2.36%
==========================================
Files 422 791 +369
Lines 193692 276612 +82920
Branches 29881 53121 +23240
==========================================
+ Hits 179718 250154 +70436
- Misses 13645 16858 +3213
- Partials 329 9600 +9271
🚀 New features to boost your workflow:
|
Contributor
Author
|
Note on coverage: The two partials are the elevated-privilege branch of |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NODE_EXTRA_CA_CERTSset through--env-fileappeared inprocess.env, but its certificates were not loaded because the startup lookup ran before the env files were applied.Read the value from the parsed env files when it is absent from the process environment. This supports both
--env-fileand--env-file-if-exists, preserves environment precedence, and uses case-insensitive lookup on Windows.Both lookups share the existing
SafeGetenv()privilege check, so the env-file fallback cannot bypass it. Runtime changes, includingprocess.loadEnvFile(), still do not reload certificates; the documentation now states this explicitly.This revisits #51497, where review raised the concern that reading from env files could bypass
SafeGetenv()'s privilege checks. Both lookups now share that check, addressing the concern.Regression tests cover both flags, environment precedence, lowercase variable names on Windows, and a TLS connection that requires the extra CA.
Fixes: #51426
Refs: #51497