--use-system-ca fails to start with bad OPENSSL_CONF set

[Julusian]

Version

26.1.0 (also seen with 22.22.2)

Platform

Microsoft Windows NT 10.0.26200.0 x64

Only windows has been tested

Subsystem

No response

What steps will reproduce the bug?

In powershell

$env:OPENSSL_CONF="c:"
node --use-system-ca

How often does it reproduce? Is there a required condition?

This happens consistently when there is a bad OPENSSL_CONF variable set

What is the expected behavior? Why is that the expected behavior?

I would expect it to fail to load some certificates/configs, but succeed with the good items in the variables and launch correctly.

What do you see instead?

PS C:\Users\farad> $env:OPENSSL_CONF="c:"
PS C:\Users\farad> node --use-system-ca
C:\Users\farad\AppData\Local\fnm_multishells\11396_1778525811252\node.exe: OpenSSL configuration error:
44190000:error:80000005:system library:BIO_new_file:Input/output error:openssl\crypto\bio\bss_file.c:67:calling fopen(c:, rb)

And node exits

Additional information

Related #58990

I can appreciate this may be openssl behaviour that cannot be controlled.

In our application we are using nodejs binaries to spawn some child processes. We want to set this flag to make the use of corporate deployed certificates easier, but have encountered an application which sets OPENSSL_CONF to a directory and causes node to fail to start.

This also appears to affect binaries built with @yao/pkg

I have checked that this is not unique to being installed through fnm

[haramj]

Hi @Julusian, I'm interested in working on this issue.

I've investigated the code in src/node.cc and found that the failure to load OpenSSL configuration during the early startup phase (InitializeOncePerProcessInternal) is treated as a fatal error, which forces the process to exit.

I’ve already tested a fix locally on macOS that changes this behavior to emit a warning instead of a fatal error. With this change, even if OPENSSL_CONF points to a directory, Node.js outputs the warning but continues to boot and execute JavaScript successfully.

Example of the output with my fix:

$export OPENSSL_CONF=/tmp$ ./node --use-system-ca -e "console.log('I am alive!')"
Warning: OpenSSL configuration error:
... (OpenSSL error details) ...
I am alive!