Skip to content

crypto,tls: clone X.509 chains across isolates - #66898

Open
panva wants to merge 1 commit into
nodejs:mainfrom
panva:x509-chain-snapshots
Open

panva wants to merge 1 commit into
nodejs:mainfrom
panva:x509-chain-snapshots

Conversation

@panva

@panva panva commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

X509Certificate cloning drops issuerCertificate and shares its native X509 object with the receiving isolate. Snapshot the leaf and supplied peer chain as DER, then parse separate native certificates in each isolate.

Construct the JavaScript chain iteratively for TLS inspection, structuredClone(), MessagePort, and workers. Each supplied position gets its own object, including repeated certificate encodings.

This is PR 1 out of 4 in an X.509 series addressing #48730 and #51169

X509Certificate cloning drops issuerCertificate and shares its native
X509 object with the receiving isolate. Snapshot the leaf and supplied
peer chain as DER, then parse separate native certificates in each
isolate.

Construct the JavaScript chain iteratively for TLS inspection,
structuredClone(), MessagePort, and workers. Each supplied position
gets its own object, including repeated certificate encodings.

Refs: nodejs#65602
Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva
panva requested a review from pimterry October 21, 2026 13:23
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. dependencies PRs that add, update, or configure Node.js dependencies. needs-ci PRs that need a full CI run. labels Oct 21, 2026
@panva
panva requested a review from jasnell October 21, 2026 13:33
@codecov

codecov Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 60.64516% with 61 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.56%. Comparing base (697ecce) to head (5c06e67).
⚠️ Report is 6 commits behind head on main.

Files with missing lines Patch % Lines
src/crypto/crypto_x509.cc 60.92% 34 Missing and 25 partials ⚠️
src/crypto/crypto_x509.h 50.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #66898      +/-   ##
==========================================
- Coverage   90.59%   90.56%   -0.03%     
==========================================
  Files         797      797              
  Lines      278486   278608     +122     
  Branches    53540    53559      +19     
==========================================
+ Hits       252291   252323      +32     
- Misses      16543    16605      +62     
- Partials     9652     9680      +28     
Files with missing lines Coverage Δ
src/crypto/crypto_x509.h 55.55% <50.00%> (+2.61%) ⬆️
src/crypto/crypto_x509.cc 71.69% <60.92%> (-1.39%) ⬇️

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. dependencies PRs that add, update, or configure Node.js dependencies. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants