win-ca

Get Windows System Root certificates for Node.js.

Rationale

Unlike Ruby, Node.js on Windows allows HTTPS requests out-of-box. But it is implemented in a rather bizzare way:

Node uses a statically compiled, manually updated, hardcoded list of certificate authorities, rather than relying on the system's trust store... Read more

It's very strange behavour under any OS, but Windows differs from most of them by having its own trust store, fully incompatible with OpenSSL.

This package is intended to fetch Root CAs from Windows' store (Trusted Root Certification Authorities) and make them available to Node.js application with minimal efforts.

Advantages

• No internet access is required at all
• Windows store is updated automatically (in most modern environments)
• Manually installed Root certificates are used
• Enterpise trusted certificates (GPO etc.) are made available too

Usage

Just say npm install --save win-ca and then call require('win-ca').

It is safe to use it under other OSes (not M$ Windows).

API

After require('win-ca') Windows' Root CAs are found, deduplicated and installed to https.globalAgent.options.ca so they are automatically used for all requests with Node.js' https module.

For use in other places, these certificates are also available via .all() method (in node-forge's format).

let ca = require('win-ca')
let forge = require('node-forge')

for (let crt of ca.all())
  console.log(forge.pki.certificateToPem(crt))

One can enumerate Root CAs himself using .each() method:

let ca = require('win-ca')

ca.each(crt=>
  console.log(forge.pki.certificateToPem(crt)))

But this list may contain duplicates.

Asynchronous enumeration is provided via .async() method:

let ca = require('win-ca')

ca.each.async((error, crt)=> {
  if (error) throw error;
  if(crt)
    console.log(forge.pki.certificateToPem(crt))
  else
    console.log("That's all folks!")
})

Finally, win-ca saves fetched ceritificates to disk for use by other soft. Path to folder containing all the certificates is available as require('win-ca').path. Environment variable SSL_CERT_DIR is set to point at it, so OpenSSL-based software will use it automatically. The layout of that folder mimics that of OpenSSL's c_rehash utility.

Availability

Current version uses N-API, so it can be used in Node.js versions with N-API support, i.e. v6 and all versions starting from v8.

Thanks to N-API it is possible to precompile Windows DLL and save it to package, so no compilation is needed at installation.

For other Node.js versions (v4, 5 or 7) speciall fallback utility is called in the background to fetch the list anyway.

Building

• npm install
• npm run pretest
• npm run nvm$
• npm publish

This builds both x86 and x64 versions with N-API support. For older Node.js versions standalone binary utility is built.

Credits

Uses node-forge and used to use node-ffi-napi (ancestor of node-ffi).

See also OpenSSL::Win::Root.