Would be good to get some pointers on where to start building this, for anyone who is interested in doing so.

Am I right that the place to start would be the https or tls modules within Node core?

Am I right that the place to start would be the https or tls modules within Node core?

Not sure, but I think it would probably have to be written in C++ somewhere in src/crypto

I'm wondering if using the Network framework for HTTPS requests might tangentially be helpful for Electron apps, and other Mac apps that use Node...

If you submit an app to the App Store that is deemed to use cryptography, you normally have to do some extra export compliance paperwork. However there are exemptions if you're just using encryption that's built into the OS.

Apple's docs (https://developer.apple.com/documentation/security/complying_with_encryption_export_regulations) say:

Typically, the use of encryption that’s built into the operating system—for example, when your app makes HTTPS connections using URLSession—is exempt from export documentation upload requirements, whereas the use of proprietary encryption is not. To determine whether your use of encryption is considered exempt, see Determine your export compliance requirements.

So perhaps if the Node https API was backed by URLSession (one of the main Network classes), we could benefit from the exemption.

Having done the US Dept Commerce export restrictions dance in a previous life working for a company that published our own build of Linux, I can confirm that leveraging the OS is a much easier route to go down.

Functionally, this enhancement is pretty important for organizations that are using technologies such as Cisco Umbrella - it spoofs DNS and is essentially a "corporate security approved man-in-the-middle", generating its own SSL certs on the fly. Right now, node apps running behind such a regime cannot connect successfully to any site that Umbrella is intercepting because the SSL certs that Umbrella generates have their own root cert installed in the Apple System keychain. (Note: not in the System Roots keychain). Node would need to look in both keychains to be successful in such an environment - easiest way to do this is via the OS framework.

Working around this is a pain for anyone with a corporate machine/proxy - node should ideally respect the CAs installed on macos

This feature request comes up every 1.5 years or so. It's never been implemented and the chances of it happening this time are... let's say, no better than before.

The reason node works the way it does is consistency. Node version x.y.z works exactly the same on every platform. Important for apps and libraries.

Previous discussions also ran aground on questions like "what if there is more than one trust store?" (Case in point: my Linux box has two. Which one is leading?)

I put together a package that lets you use the system's trust store: https://github.com/bnoordhuis/node-native-certs

Uses the same library that Deno uses. Not yet published because I need to wrangle GitHub Actions into publishing the build artifacts somehow (it's a native library.)

If an Actions guru wants to chip in, that'd be very welcome.

@bnoordhuis thanks for your contribution, and good to know it's the same as Deno under the covers. I'll see if I can rustle up a GitHub Action for you

I put together a package that lets you use the system's trust store: https://github.com/bnoordhuis/node-native-certs

Uses the same library that Deno uses. Not yet published because I need to wrangle GitHub Actions into publishing the build artifacts somehow (it's a native library.)

If an Actions guru wants to chip in, that'd be very welcome.

As a noob, could you please explain how to go about using this package to allow node to access my keychain?

This package is something that will be evolved in several iterations to integrate it closer with Node.

In the first version, you'd install the package in a project which needs to use TLS root certs from the Keychain.
You'd then need to add a bit of glue code to your app to attach the retrieved certificate bundle to your HTTPS library.

You can either put that glue code in application startup (which will attach the bundle to all future requests), or you can attach the bundle to an individual request.

For example, if you use the built-in https module you could do:

const https = require("https")
const nativeCerts = require("native-certs")
const ca = nativeCerts()

// Note that this call is async so you also need a callback handler
https.get({ca, host: "example.com", path: "/"})

Or at startup it might look like:

const https = require("https")
const nativeCerts = require("native-certs")
const ca = nativeCerts()

https.globalAgent.options.ca = ca

// later on...

https.get({host: "example.com", path: "/"})

After that, all your app's HTTPS requests will use the root certs obtained from:

• The Keychain (on macOS)
• The Windows Certificate Store (on Windows)
• The standard certificate lookup locations like /etc/ssl (on Linux)

If you want to use the certs on a different type of TLS connection (e.g. a database), you'd need to look up the respective networking library's way of specifying alternative certs.

#44532 attempted to add Windows keychain support but seems to have stalled. The fact it's Windows-only makes it less likely to get merged so maybe someone wants to adopt it and add macOS support?

Expectation management: I can't guarantee it's going to get merged but multi-platform support would definitely help strengthen its case.

@chriskilding since the native-certs is not yet on npm how could we use the library? I've tried to download the project and run the build command with cargo, but I'm not sure what I should do with the files on the target folder. Can I get some help with this please? A lib like that would be helpful for what I'm trying to achieve

Hi @diogoperes, if you want to do this on your laptop this would be called a local module install. This uses the npm link command.

More here: https://docs.npmjs.com/cli/v9/commands/npm-link

There has been no activity on this feature request for 5 months and it is unlikely to be implemented. It will be closed 6 months after the last non-automated comment.

For more information on how the project manages feature requests, please consult the feature request management document.

I think this should be kept open - it looks like there has been some progress toward something that may work...

As mentioned, use expectation would be that node works like curl - if you can curl the file you should be able to use npm to install it...

No one stepped up to do the leg work and "be like curl" is too generic to be actionable. It doesn't seem like this feature request is going anywhere and it's best to let it die off in that case.

Since there's been no follow-up and no new pull requests (edit: as far as I can see), I'll take the liberty of closing this.

I'm working on this, #56599

Would it be possible to re-open the issue please.