Commit a2ce2c6def0 for nodejs
commit a2ce2c6def0d7729c042bdfd036321ac3c79a47f
Author: Filip Skokan <panva.ip@gmail.com>
Date: Thu Oct 22 11:15:41 2026 +0200
tls,tools: update BoringSSL pin and TLS errors
Use BoringSSL 0.20261020.0 for shared-library builds and expose the
package wrapper's version to the matrix updater.
The new verifier no longer emits UNABLE_TO_VERIFY_LEAF_SIGNATURE
after Node's verification callback accepts a missing-issuer error.
Expect UNABLE_TO_GET_ISSUER_CERT_LOCALLY for the affected leaf
certificates and suggest --use-system-ca for that error.
Drop the SSL_get_server_tmp_key() fallback now that BoringSSL supplies
SSL_get_peer_tmp_key() as a compatibility stub.
Refs: https://boringssl-review.googlesource.com/c/boringssl/+/103849
Refs: https://github.com/electron/electron/pull/55110/changes/b457e70e339e8bb3066b210edfb6f96582cdb374
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index a48b953dc1b..81e6634a76e 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -5005,11 +5005,7 @@ bool SSLPointer::isServer() const {
EVPKeyPointer SSLPointer::getPeerTempKey() const {
if (!ssl_) return {};
EVP_PKEY* raw_key = nullptr;
-#ifndef OPENSSL_IS_BORINGSSL
if (!SSL_get_peer_tmp_key(get(), &raw_key)) return {};
-#else
- if (!SSL_get_server_tmp_key(get(), &raw_key)) return {};
-#endif
return EVPKeyPointer(raw_key);
}
diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index ad056b5610b..759353f08f0 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -59,6 +59,9 @@ MaybeLocal<Value> GetValidationErrorReason(Environment* env, int err) {
// Suggest --use-system-ca if the error indicates a certificate issue
bool suggest_system_ca =
(err == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) ||
+#ifdef OPENSSL_IS_BORINGSSL
+ (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
+#endif
(err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
((err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) &&
!env->options()->use_system_ca);
diff --git a/test/client-proxy/test-https-proxy-request-handshake-failure.mjs b/test/client-proxy/test-https-proxy-request-handshake-failure.mjs
index 251d136afaa..dcae2b024ff 100644
--- a/test/client-proxy/test-https-proxy-request-handshake-failure.mjs
+++ b/test/client-proxy/test-https-proxy-request-handshake-failure.mjs
@@ -13,6 +13,7 @@ if (!common.hasCrypto)
// https must be dynamically imported so that builds without crypto support
// can skip it.
const { default: https } = await import('node:https');
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
const server = https.createServer({
cert: fixtures.readKey('agent8-cert.pem'),
@@ -36,8 +37,8 @@ const { code, signal, stderr, stdout } = await runProxiedRequest({
HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
});
-// The proxy client should get a UNABLE_TO_VERIFY_LEAF_SIGNATURE during TLS handshake.
-assert.match(stderr, /UNABLE_TO_VERIFY_LEAF_SIGNATURE/);
+// The proxy client should report the untrusted leaf during the TLS handshake.
+assert.match(stderr, new RegExp(untrustedLeafErrorCode));
assert.strictEqual(stdout, '');
assert.strictEqual(code, 0);
assert.strictEqual(signal, null);
diff --git a/test/common/tls.js b/test/common/tls.js
index 8568659d13c..a841f96b614 100644
--- a/test/common/tls.js
+++ b/test/common/tls.js
@@ -4,6 +4,12 @@
const crypto = require('crypto');
const net = require('net');
const assert = require('assert');
+const { isBoringSSL } = require('./crypto');
+
+// BoringSSL reports the missing issuer directly for a lone, non-self-signed
+// leaf. OpenSSL replaces it with a leaf signature verification error.
+exports.untrustedLeafErrorCode = isBoringSSL ?
+ 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY' : 'UNABLE_TO_VERIFY_LEAF_SIGNATURE';
exports.ccs = Buffer.from('140303000101', 'hex');
diff --git a/test/internet/test-tls-add-ca-cert.js b/test/internet/test-tls-add-ca-cert.js
index 3f76f2b95e7..2ee1bbcab59 100644
--- a/test/internet/test-tls-add-ca-cert.js
+++ b/test/internet/test-tls-add-ca-cert.js
@@ -34,7 +34,7 @@ tls.connect(opts, common.mustCall(end));
// The .ca option replaces the well-known roots, so connection fails.
opts.ca = caCert;
tls.connect(opts, fail).on('error', common.mustCall((err) => {
- assert.strictEqual(err.message, 'unable to get local issuer certificate');
+ assert.strictEqual(err.code, 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY');
}));
function fail() {
diff --git a/test/parallel/test-http2-session-reuse-different-authority.js b/test/parallel/test-http2-session-reuse-different-authority.js
index d76f17a728f..7ff47e65d33 100644
--- a/test/parallel/test-http2-session-reuse-different-authority.js
+++ b/test/parallel/test-http2-session-reuse-different-authority.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
const h2 = require('http2');
const tls = require('tls');
const { once } = require('events');
@@ -125,7 +126,7 @@ server.on('stream', (stream) => {
session: first.session,
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
@@ -136,7 +137,7 @@ server.on('stream', (stream) => {
maxVersion: 'TLSv1.2',
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
} finally {
diff --git a/test/parallel/test-https-agent-create-connection.js b/test/parallel/test-https-agent-create-connection.js
index 56e967476c8..5c4c23cdbe8 100644
--- a/test/parallel/test-https-agent-create-connection.js
+++ b/test/parallel/test-https-agent-create-connection.js
@@ -5,6 +5,8 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
+const { untrustedLeafErrorCode } = require('../common/tls');
+
const assert = require('assert');
const https = require('https');
@@ -17,7 +19,6 @@ const options = {
const expectedHeader = /^HTTP\/1\.1 200 OK/;
const expectedBody = /hello world\n/;
-const expectCertError = /^UNABLE_TO_VERIFY_LEAF_SIGNATURE$/;
function checkRequest(socket, server) {
let result = '';
@@ -112,7 +113,7 @@ function createServer() {
const options = null;
const socket = agent.createConnection(port, host, options);
socket.on('error', common.mustCall((e) => {
- assert.match(e.code, expectCertError);
+ assert.strictEqual(e.code, untrustedLeafErrorCode);
server.close();
}));
}));
@@ -127,7 +128,7 @@ function createServer() {
const options = undefined;
const socket = agent.createConnection(port, host, options);
socket.on('error', common.mustCall((e) => {
- assert.match(e.code, expectCertError);
+ assert.strictEqual(e.code, untrustedLeafErrorCode);
server.close();
}));
}));
diff --git a/test/parallel/test-https-session-reuse-different-servername.js b/test/parallel/test-https-session-reuse-different-servername.js
index 138acd69350..3f2c0c62ae9 100644
--- a/test/parallel/test-https-session-reuse-different-servername.js
+++ b/test/parallel/test-https-session-reuse-different-servername.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
const https = require('https');
const tls = require('tls');
const { once } = require('events');
@@ -104,7 +105,7 @@ const server = https.createServer({
ca: [load('ca1-cert.pem')],
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
@@ -116,7 +117,7 @@ const server = https.createServer({
ca: [load('ca1-cert.pem')],
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
} finally {
diff --git a/test/parallel/test-https-simple.js b/test/parallel/test-https-simple.js
index b0562a1cd98..042bc4aa66c 100644
--- a/test/parallel/test-https-simple.js
+++ b/test/parallel/test-https-simple.js
@@ -26,6 +26,8 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
+const { untrustedLeafErrorCode } = require('../common/tls');
+
const assert = require('assert');
const https = require('https');
@@ -93,7 +95,7 @@ server.listen(0, common.mustCall(() => {
const checkCertReq = https.request(options, common.mustNotCall()).end();
checkCertReq.on('error', common.mustCall((e) => {
- assert.strictEqual(e.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(e.code, untrustedLeafErrorCode);
done();
}));
}));
diff --git a/test/parallel/test-https-strict.js b/test/parallel/test-https-strict.js
index a72168289d5..3b27753209f 100644
--- a/test/parallel/test-https-strict.js
+++ b/test/parallel/test-https-strict.js
@@ -25,6 +25,8 @@ const fixtures = require('../common/fixtures');
if (!common.hasCrypto)
common.skip('missing crypto');
+const { untrustedLeafErrorCode } = require('../common/tls');
+
// Disable strict server certificate validation by the client
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
@@ -167,7 +169,7 @@ function allListening() {
const port3 = server3.address().port;
// server1: host 'agent1', signed by ca1
- makeReq('/inv1', port1, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ makeReq('/inv1', port1, untrustedLeafErrorCode);
makeReq('/inv1-ca1', port1, 'ERR_TLS_CERT_ALTNAME_INVALID',
null, ca1);
makeReq('/inv1-ca1ca2', port1, 'ERR_TLS_CERT_ALTNAME_INVALID',
@@ -175,7 +177,7 @@ function allListening() {
makeReq('/val1-ca1', port1, null, 'agent1', ca1);
makeReq('/val1-ca1ca2', port1, null, 'agent1', [ca1, ca2]);
makeReq('/inv1-ca2', port1,
- 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'agent1', ca2);
+ untrustedLeafErrorCode, 'agent1', ca2);
// server2: self-signed, host = 'agent2'
// doesn't matter that thename matches, all of these will error.
@@ -186,14 +188,14 @@ function allListening() {
'agent2', [ca1, ca2]);
// server3: host 'agent3', signed by ca2
- makeReq('/inv3', port3, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ makeReq('/inv3', port3, untrustedLeafErrorCode);
makeReq('/inv3-ca2', port3, 'ERR_TLS_CERT_ALTNAME_INVALID', null, ca2);
makeReq('/inv3-ca1ca2', port3, 'ERR_TLS_CERT_ALTNAME_INVALID',
null, [ca1, ca2]);
makeReq('/val3-ca2', port3, null, 'agent3', ca2);
makeReq('/val3-ca1ca2', port3, null, 'agent3', [ca1, ca2]);
makeReq('/inv3-ca1', port3,
- 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'agent1', ca1);
+ untrustedLeafErrorCode, 'agent1', ca1);
}
diff --git a/test/parallel/test-tls-addca.js b/test/parallel/test-tls-addca.js
index a99d53f55d3..4935350b857 100644
--- a/test/parallel/test-tls-addca.js
+++ b/test/parallel/test-tls-addca.js
@@ -9,6 +9,7 @@ const fixtures = require('../common/fixtures');
const {
assert, connect, keys, tls
} = require(fixtures.path('tls-connect'));
+const { untrustedLeafErrorCode } = require('../common/tls');
const contextWithoutCert = tls.createSecureContext({});
const contextWithCert = tls.createSecureContext({});
@@ -34,7 +35,7 @@ connect({
server: serverOptions,
}, common.mustCall((err, pair, cleanup) => {
assert(err);
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
cleanup();
// This time it should connect because contextWithCert includes the needed CA
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index da06156e2e0..509dc3f4bd6 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -11,6 +11,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
const {
assert, connect, keys, tls
} = require(fixtures.path('tls-connect'));
+const { untrustedLeafErrorCode } = require('../common/tls');
// Use ec10 and agent10, they are the only identities with intermediate CAs.
const client = keys.ec10;
@@ -185,7 +186,7 @@ connect({
cert: server.single,
},
}, common.mustCall((err, pair, cleanup) => {
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
return cleanup();
}));
diff --git a/test/parallel/test-tls-client-cert-resumption.js b/test/parallel/test-tls-client-cert-resumption.js
index 790809678d6..3fb90e0080c 100644
--- a/test/parallel/test-tls-client-cert-resumption.js
+++ b/test/parallel/test-tls-client-cert-resumption.js
@@ -22,6 +22,7 @@ const assert = require('assert');
const crypto = require('crypto');
const tls = require('tls');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
const { once } = require('events');
const ca = fixtures.readKey('ca1-cert.pem');
@@ -47,7 +48,7 @@ const CLIENTS = {
cert: fixtures.readKey('agent3-cert.pem'),
},
authorized: false,
- authorizationError: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ authorizationError: untrustedLeafErrorCode,
peerCN: 'agent3',
},
missing: { // No client certificate
diff --git a/test/parallel/test-tls-friendly-error-message.js b/test/parallel/test-tls-friendly-error-message.js
index 84471da487b..2d734789e3d 100644
--- a/test/parallel/test-tls-friendly-error-message.js
+++ b/test/parallel/test-tls-friendly-error-message.js
@@ -25,6 +25,7 @@ if (!common.hasCrypto)
common.skip('missing crypto');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
const assert = require('assert');
const tls = require('tls');
@@ -39,6 +40,7 @@ tls.createServer({ key, cert }).on('connection', common.mustCall(function() {
})).listen(0, common.mustCall(function() {
const options = { port: this.address().port, rejectUnauthorized: true };
tls.connect(options).on('error', common.mustCall(function(err) {
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
+ assert.match(err.message, /try running Node\.js with --use-system-ca/);
}));
}));
diff --git a/test/parallel/test-tls-session-reuse-different-servername.js b/test/parallel/test-tls-session-reuse-different-servername.js
index c3ae4be1578..1692f6bab05 100644
--- a/test/parallel/test-tls-session-reuse-different-servername.js
+++ b/test/parallel/test-tls-session-reuse-different-servername.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
const assert = require('assert');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
const tls = require('tls');
const { once } = require('events');
@@ -90,7 +91,7 @@ async function testVersion(minVersion, maxVersion) {
return socket;
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
@@ -107,7 +108,7 @@ async function testVersion(minVersion, maxVersion) {
return socket;
}),
{
- code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+ code: untrustedLeafErrorCode,
},
);
} finally {
diff --git a/test/parallel/test-tls-set-default-ca-certificates-append-fetch.mjs b/test/parallel/test-tls-set-default-ca-certificates-append-fetch.mjs
index ca8436b22b0..af27acb7bf4 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-append-fetch.mjs
+++ b/test/parallel/test-tls-set-default-ca-certificates-append-fetch.mjs
@@ -11,7 +11,7 @@ import assert from 'node:assert';
if (!common.hasCrypto) common.skip('missing crypto');
-const { includesCert } = await import('../common/tls.js');
+const { includesCert, untrustedLeafErrorCode } = await import('../common/tls.js');
const { default: https } = await import('node:https');
const { default: tls } = await import('node:tls');
@@ -37,7 +37,7 @@ const url = `https://localhost:${server.address().port}/hello-world`;
await assert.rejects(
fetch(url),
(err) => {
- assert.strictEqual(err.cause.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.cause.code, untrustedLeafErrorCode);
return true;
},
);
diff --git a/test/parallel/test-tls-set-default-ca-certificates-append-https-request.js b/test/parallel/test-tls-set-default-ca-certificates-append-https-request.js
index d7a3baded42..f20cb010ca8 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-append-https-request.js
+++ b/test/parallel/test-tls-set-default-ca-certificates-append-https-request.js
@@ -10,7 +10,7 @@ const assert = require('assert');
const https = require('https');
const tls = require('tls');
const fixtures = require('../common/fixtures');
-const { includesCert } = require('../common/tls');
+const { includesCert, untrustedLeafErrorCode } = require('../common/tls');
const bundledCerts = tls.getCACertificates('bundled');
const fixtureCert = fixtures.readKey('fake-startcom-root-cert.pem');
@@ -43,7 +43,7 @@ server.listen(0, common.mustCall(() => {
req1.on('error', common.mustCall((err) => {
console.log(err);
// Should fail with certificate verification error
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
// Now add the fake-startcom-root-cert to bundled certs - connection should succeed
tls.setDefaultCACertificates([...bundledCerts, fixtureCert]);
diff --git a/test/parallel/test-tls-set-default-ca-certificates-reset-fetch.mjs b/test/parallel/test-tls-set-default-ca-certificates-reset-fetch.mjs
index 479b415d4c5..363497cbe82 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-reset-fetch.mjs
+++ b/test/parallel/test-tls-set-default-ca-certificates-reset-fetch.mjs
@@ -11,6 +11,7 @@ import assert from 'node:assert';
if (!common.hasCrypto) common.skip('missing crypto');
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
const { default: https } = await import('node:https');
const { default: tls } = await import('node:tls');
@@ -39,7 +40,7 @@ tls.setDefaultCACertificates([]);
await assert.rejects(
fetch(`https://127.0.0.1:${server.address().port}/empty-ca-test`),
(err) => {
- assert.strictEqual(err.cause.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.cause.code, untrustedLeafErrorCode);
return true;
},
);
diff --git a/test/parallel/test-tls-set-default-ca-certificates-reset-https-request.js b/test/parallel/test-tls-set-default-ca-certificates-reset-https-request.js
index 7389cacf6d6..b4fe577ab46 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-reset-https-request.js
+++ b/test/parallel/test-tls-set-default-ca-certificates-reset-https-request.js
@@ -9,6 +9,7 @@ const assert = require('assert');
const https = require('https');
const tls = require('tls');
const fixtures = require('../common/fixtures');
+const { untrustedLeafErrorCode } = require('../common/tls');
// Test HTTPS connection succeeds with proper CA, fails after removing it
const server = https.createServer({
@@ -49,7 +50,7 @@ server.listen(0, common.mustCall(() => {
req2.on('error', common.mustCall((err) => {
// Should fail with certificate verification error.
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
server.close();
}));
diff --git a/test/parallel/test-tls-socket-default-options.js b/test/parallel/test-tls-socket-default-options.js
index 8dfd912285d..e7ad1be3d42 100644
--- a/test/parallel/test-tls-socket-default-options.js
+++ b/test/parallel/test-tls-socket-default-options.js
@@ -8,13 +8,14 @@ const assert = require('assert');
const {
connect, keys, tls
} = require(fixtures.path('tls-connect'));
+const { untrustedLeafErrorCode } = require('../common/tls');
test(undefined, (err) => {
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
});
test({}, (err) => {
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
});
test(
@@ -30,8 +31,7 @@ test(
test(
{ secureContext: tls.createSecureContext(), ca: keys.agent1.ca },
(err) => {
- assert.strictEqual(err.code,
- 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
});
function test(client, callback) {
@@ -42,7 +42,7 @@ function test(client, callback) {
cert: keys.agent1.cert,
},
}, common.mustCall(function(err, pair, cleanup) {
- assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.code, untrustedLeafErrorCode);
let recv = '';
pair.server.server.once('secureConnection', common.mustCall((conn) => {
conn.on('data', (data) => recv += data);
diff --git a/test/system-ca/test-native-intermediate-certs.mjs b/test/system-ca/test-native-intermediate-certs.mjs
index edf1315422f..9638176b9be 100644
--- a/test/system-ca/test-native-intermediate-certs.mjs
+++ b/test/system-ca/test-native-intermediate-certs.mjs
@@ -11,6 +11,8 @@ if (!common.hasCrypto) {
common.skip('requires crypto');
}
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
+
// To run this test, the system needs to be configured to trust
// the CA certificate first (which needs an interactive GUI approval, e.g. TouchID):
// see the README.md in this folder for instructions on how to do this.
@@ -72,7 +74,7 @@ describe('use-system-ca', function() {
if (common.isWindows) {
assert.strictEqual(err.cause.code, 'UNABLE_TO_GET_ISSUER_CERT');
} else {
- assert.strictEqual(err.cause.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.cause.code, untrustedLeafErrorCode);
}
}
});
diff --git a/test/system-ca/test-set-default-ca-certificates-append-system-ca.mjs b/test/system-ca/test-set-default-ca-certificates-append-system-ca.mjs
index 0cbd9804c36..c9a4cc25a04 100644
--- a/test/system-ca/test-set-default-ca-certificates-append-system-ca.mjs
+++ b/test/system-ca/test-set-default-ca-certificates-append-system-ca.mjs
@@ -13,6 +13,7 @@ if (!common.hasCrypto) {
common.skip('requires crypto');
}
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
const { default: https } = await import('node:https');
const { default: tls } = await import('node:tls');
@@ -32,7 +33,7 @@ const url = `https://localhost:${server.address().port}/hello-world`;
await assert.rejects(
fetch(url),
(err) => {
- assert.strictEqual(err.cause.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.cause.code, untrustedLeafErrorCode);
return true;
},
);
diff --git a/test/system-ca/test-use-system-ca-worker-disable.mjs b/test/system-ca/test-use-system-ca-worker-disable.mjs
index 43f3f293760..be8497bb54c 100644
--- a/test/system-ca/test-use-system-ca-worker-disable.mjs
+++ b/test/system-ca/test-use-system-ca-worker-disable.mjs
@@ -14,6 +14,8 @@ if (!common.hasCrypto) {
common.skip('requires crypto');
}
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
+
// To run this test, the system needs to be configured to trust
// the CA certificate first (which needs an interactive GUI approval, e.g. TouchID):
// see the README.md in this folder for instructions on how to do this.
@@ -61,7 +63,7 @@ describe('use-system-ca', function() {
const [message] = await once(worker, 'message');
assert.strictEqual(message.ok, false);
assert(
- message.code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' ||
+ message.code === untrustedLeafErrorCode ||
message.code === 'SELF_SIGNED_CERT_IN_CHAIN',
`Expected certificate verification error but got: ${JSON.stringify(
message,
diff --git a/test/system-ca/test-use-system-ca-worker-enable.mjs b/test/system-ca/test-use-system-ca-worker-enable.mjs
index f5f3faab481..3b8d7d71a71 100644
--- a/test/system-ca/test-use-system-ca-worker-enable.mjs
+++ b/test/system-ca/test-use-system-ca-worker-enable.mjs
@@ -14,6 +14,8 @@ if (!common.hasCrypto) {
common.skip('requires crypto');
}
+const { untrustedLeafErrorCode } = await import('../common/tls.js');
+
// To run this test, the system needs to be configured to trust
// the CA certificate first (which needs an interactive GUI approval, e.g. TouchID):
// see the README.md in this folder for instructions on how to do this.
@@ -57,7 +59,7 @@ describe('use-system-ca', function() {
workerData: { url },
});
await assert.rejects(fetch(url), (err) => {
- assert.strictEqual(err.cause.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
+ assert.strictEqual(err.cause.code, untrustedLeafErrorCode);
return true;
});
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index 42b2e183e12..d81bf445a79 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -21,13 +21,20 @@ else
openssl_3
;
- # TODO: remove this when the pin we use has picked up https://boringssl-review.googlesource.com/c/boringssl/+/104208
boringssl =
let
- inherit (nixpkgs) boringssl lib writeTextFile;
+ inherit (nixpkgs) callPackage lib writeTextFile;
+ # TODO: remove this override once nixpkgs.boringssl is 0.20261020.0 or newer.
+ boringssl = callPackage (builtins.fetchurl {
+ url = "${repo}/raw/1c17f6e5f086bf6b259e7a28f68657ed8548a25a/pkgs/by-name/bo/boringssl/package.nix";
+ sha256 = "10cw2np6shjanxa2vzfxsrbyz451g1b6qan2v9c1ln75i3n5zn8a";
+ }) { };
in
+ # BoringSSL does not install the openssl.pc metadata required by configure.
+ # https://boringssl-review.googlesource.com/c/boringssl/+/104208
writeTextFile {
inherit (boringssl) name;
+ passthru = { inherit (boringssl) version; };
destination = "/lib/pkgconfig/openssl.pc";
text = ''
Name: BoringSSL