tls: read the peer certificate chain without consuming it - #65602
Closed
tgies wants to merge 1 commit into
Closed
Conversation
X509Certificate::GetPeerCert() built the certificate objects by deleting entries from the stack returned by SSL_get_peer_cert_chain(), which is owned by the SSL session. The first read emptied it, so any later read by getPeerCertificate() or getPeerX509Certificate(), on either peer, saw a truncated chain or nothing. Copy each issuer with X509_dup instead and leave the session's stack untouched. onServerSocketSecure() only called getPeerX509Certificate() to check whether a peer certificate was present, building the whole chain on every server handshake; that is what first exposed the destructive read. Use a lightweight hasPeerCertificate() binding for the presence check. Signed-off-by: Tony Gies <tgies@tgies.net>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
Author
|
BTW, the argument for adding the |
This was referenced Aug 27, 2026
tgies
added a commit
to tgies/client-certificate-auth
that referenced
this pull request
Aug 28, 2026
Node 26.8.0 stopped exposing the server-side peer chain via getPeerCertificate(true) (nodejs/node#65579, fix nodejs/node#65602), so the socket-path includeChain test failed there. It now probes the running Node once and asserts the issuerCertificate chain only when the runtime still exposes it. README and the troubleshooting guide note the regression and the allowFingerprints/allowCA/header-path workarounds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Server-side
getPeerCertificate(true)stopped returning the client certificate's issuer chain in v26.8.0.issuerCertificatebecameundefined.The root cause actually predates this regression;
X509Certificate::GetPeerCert()walked the stack fromSSL_get_peer_cert_chain()withsk_X509_delete(), so the first read destroyed the chain for every later read. #64677 added an internal call togetPeerX509Certificate()inonServerSocketSecure()to detect presence of a certificate, so now the mutating read happens every time.This changes
getPeerX509Certificate()to read the chain non-destructively, copying issuers withX509_dup, and replaces the presence check with ahasPeerCertificate()binding.Fixes: #65579
Refs: #64677