Skip to content

tls: optimize root cert handling during startup, store as DER #45768

Closed as not planned
Closed as not planned
tls: optimize root cert handling during startup, store as DER#45768
Labels
cryptoIssues and PRs related to the crypto subsystem.performanceIssues and PRs related to the performance of Node.js.staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.tlsIssues and PRs related to the tls subsystem.

Description

@bnoordhuis
bnoordhuis
opened on Dec 7, 2022

The root certificates are currently baked into the binary as PEM - basically base64-encoded binary data.

On startup, node dutifully turns each of the ~140 certifcates into a X509 instance with PEM_read_bio_X509(), which decodes the PEM to DER before passing it to d2i_X509().

You can see where this is going: it's a lot more efficient to store the certificates as DER and pass them to d2i_X509() directly.

One caveat: tls.rootCertificates is documented to be an array of PEM strings. Can be fixed by turning the DER objects into PEM in GetRootCertificates() in src/crypto/crypto_context.cc.

Activity

  1. bnoordhuis
    added
    tlsIssues and PRs related to the tls subsystem.
    cryptoIssues and PRs related to the crypto subsystem.
    performanceIssues and PRs related to the performance of Node.js.
    on Dec 7, 2022

  2. krk commented on Jan 10, 2023

    @krk
    krk
    on Jan 10, 2023
    Contributor

    Performance looks like related to openssl/openssl#19119

  3. joyeecheung commented on Feb 7, 2025

    @joyeecheung
    joyeecheung
    on Feb 7, 2025
    Member

    Cross referencing conversations in #56843 - I was looking into it since we are now appending root certificates from system store under --use-system-ca, so it's even weirder that we convert them into PEM to append them, only to deserialize later.

    @joyeecheung

    By the way I wonder what we think about migrating away from tools/mk-ca-bundle.pl, I am thinking about updating it to output the certificate data in octal literals in #56832 to skip the unnecessary serdes cost, but then if we are changing it substantially, we might as well just rewrite it in JavaScript instead of invoking a Perl script from JavaScript (and the Perl script already has some modifications from our side, like omitting TrustCor CAs)

    @richardlau

    I think if we're not planning to resync to upstream curl's version of the tool at any point in the future (I think it was tried once and abandoned) then rewriting in something other than Perl would be a plus.

    Maybe this discussion should be an issue to itself. FWIW https://blog.mozilla.org/security/2021/05/10/beware-of-applications-misusing-root-stores/ recommends https://www.ccadb.org/resources rather than parsing certdata.txt.

  4. github-actions commented on Jun 23, 2026

    @github-actions
    github-actionsBot
    on Jun 23, 2026 – with GitHub Actions
    Contributor

    This issue has been marked as stale due to 210 days of inactivity.
    It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

  5. github-actions
    added
    staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.
    on Jun 23, 2026

  6. github-actions commented on Jul 24, 2026

    @github-actions
    github-actionsBot
    on Jul 24, 2026 – with GitHub Actions
    Contributor

    This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 120 days).
    If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.

  7. github-actions
    closed this as not plannedon Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.performanceIssues and PRs related to the performance of Node.js.staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.tlsIssues and PRs related to the tls subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions