win-ca-ffi

win-ca

Get Windows System Root certificates for Node.js.

Rationale

Unlike Ruby, Node.js on Windows allows HTTPS requests out-of-box. But it is implemented in a rather bizzare way:

Node uses a statically compiled, manually updated, hardcoded list of certificate authorities, rather than relying on the system's trust store... Read more

It's very strange behavour under any OS, but Windows differs from most of them by having its own trust store, fully incompatible with OpenSSL.

This package is intended to fetch Root CAs from Windows' store and make them available to Node.js application with minimal efforts.

Advantages

• No internet access is required at all
• Windows store is updated automatically (in most modern environments)
• Manually installed Root certificates are used
• Enterpise trusted certificates (GPO etc.) are made available too

Usage

Just say npm install --save win-ca and then call require('win-ca').

It is safe to use it under other OSes (not M$ Windows).

API

After require('win-ca') Windows' Root CAs are found, deduplicated and installed to https.globalAgent.options.ca so they are automatically used for all requests with Node.js' https module.

For use in other places, these certificates are available via .all() method (in node-forge's format).

ca = require 'win-ca'
forge = require 'node-forge'

for crt in ca.all()
  dst.write forge.pki.certificateToPem crt

One can enumerate Root CAs himself using .each() method:

ca = require 'win-ca'

ca.each (crt)->
  dst.write forge.pki.certificateToPem crt

But this list may contain duplicates.

Asynchronous enumeration is provided via .async() method:

ca = require 'win-ca'

ca.async (error, crt)->
  throw error if error
  if crt
    dst.write forge.pki.certificateToPem crt
  else
    console.log "That's all folks!"

Finally, win-ca saves fetched ceritificates to disk for use by other soft. Path to folder containing all the certificates is available as require('win-ca').path. Environment variable SSL_CERT_DIR is set to point at it, so OpenSSL-based software will use it automatically. The layout of that folder mimics that of OpenSSL's c_rehash utility.

Building

• npm install
• npm test
• npm publish
• cd top
• npm publish

Credits

Uses node-forge and node-ffi.

See also OpenSSL::Win::Root.