fix(ext/node): accept array forms of cert/key/pfx in createSecureContext#34379
Merged
Conversation
`tls.createSecureContext` did not honor the documented array forms of
`cert`, `key` and `pfx`. Array `cert` / `key` values were silently
coerced via `String(...)` to unusable strings (`[object Object]` or a
comma-joined byte sequence), so rustls saw no client certificate. An
empty `pfx: []` (as emitted by playwright's
`convertClientCertificatesToTLSOptions` when only PEM cert/key are
configured) fell into the PFX validator with an empty buffer and threw
"not enough data".
This change adds `normalizeCertPem` and `normalizeKeyPem` helpers that
flatten arrays into single PEM strings, unwrap the `{ pem, passphrase }`
shape, and decrypt passphrase-protected keys via `createPrivateKey` so
the resulting PEM is consumable by `rustls_pemfile`. The PFX validation
loop now iterates arrays (and `{ buf, passphrase }` entries) and skips
empty arrays.
Fixes #34367, #34371.
fibibot
approved these changes
May 25, 2026
fibibot
left a comment
fibibot
left a comment
Contributor
There was a problem hiding this comment.
Array handling now matches the Node forms that this path consumes: cert arrays are concatenated before rustls sees them, key array objects keep per-entry passphrases, and pfx arrays are validated entry-by-entry while [] stays a no-op. The regression test covers the empty pfx case, array cert/key, duplicate PEM blocks, and malformed PFX errors.
littledivy
previously requested changes
May 26, 2026
| if (buf == null) continue; | ||
| const pfxData = toUint8Array(buf); | ||
| const pfxPassphrase = passphrase != null ? String(passphrase) : null; | ||
| op_node_validate_pfx(pfxData, pfxPassphrase); |
Member
There was a problem hiding this comment.
verify_mac in op_node_validate_pfx hardcodes SHA-1 for both PKDF#12 and HMAC. It requires this fix #34342
…t-array-forms # Conflicts: # tests/unit_node/tls_test.ts
littledivy
pushed a commit
to crowlKats/deno
that referenced
this pull request
Jun 10, 2026
…ext (denoland#34379) `tls.createSecureContext` did not honor the documented array forms of `cert`, `key` and `pfx` (see https://nodejs.org/api/tls.html#tlscreatesecurecontextoptions). Array `cert` / `key` values were silently coerced via `String(...)` to unusable strings (`[object Object]` or a comma-joined byte sequence), so rustls saw no client certificate and TLS proceeded as anonymous. An empty `pfx: []` (as emitted by playwright's `convertClientCertificatesToTLSOptions` when only PEM cert/key are configured) fell into the PFX validator with an empty buffer and threw "not enough data". The polyfill now flattens cert/key arrays into a single PEM string, unwraps the `{ pem, passphrase }` shape, and decrypts passphrase-protected keys via `createPrivateKey` so the result is parseable by `rustls_pemfile`. The PFX validation loop iterates arrays (and `{ buf, passphrase }` entries) and treats empty arrays as a no-op, matching Node. Fixes denoland#34367 Fixes denoland#34371
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tls.createSecureContextdid not honor the documented array forms ofcert,keyandpfx(seehttps://nodejs.org/api/tls.html#tlscreatesecurecontextoptions). Array
cert/keyvalues were silently coerced viaString(...)tounusable strings (
[object Object]or a comma-joined byte sequence),so rustls saw no client certificate and TLS proceeded as anonymous. An
empty
pfx: [](as emitted by playwright'sconvertClientCertificatesToTLSOptionswhen only PEM cert/key areconfigured) fell into the PFX validator with an empty buffer and threw
"not enough data".
The polyfill now flattens cert/key arrays into a single PEM string,
unwraps the
{ pem, passphrase }shape, and decryptspassphrase-protected keys via
createPrivateKeyso the result isparseable by
rustls_pemfile. The PFX validation loop iterates arrays(and
{ buf, passphrase }entries) and treats empty arrays as ano-op, matching Node.
Fixes #34367
Fixes #34371