tools: generate distrust-after dates from certdata.txt

Mozilla's CKA_NSS_SERVER_DISTRUST_AFTER dates are enforced by the
distrust-after table in src/crypto/crypto_context.cc, which so far had to
be typed by hand: find the root in certdata.txt, hash its public key,
convert the date to an epoch. The emSign G1 entry was first written with
the wrong year, which is the kind of slip a generator avoids.

Add tools/mk-root-certs-distrust.mjs, which reads tools/certdata.txt and
src/node_root_certs.h and writes src/node_root_certs_distrust.h with one
entry per bundled root that carries a distrust-after date. The verify
callback includes that header as kDistrustAfterBundled and keeps the
hand-written table for dates Mozilla publishes between NSS releases and
for the test fixture. update-root-certs.mjs runs the generator after
mk-ca-bundle.pl and reports date changes in the commit message it
produces, so the weekly root-certificates job picks new dates up with
no extra step. A test regenerates the header and fails when the
committed copy is out of date with certdata.txt.

With the current certdata.txt snapshot the generated table holds
Izenpe.com only; emSign Root CA - G1 and Firmaprofesional stay in the
hand-written table until the next root certificate update brings their
dates in.

Refs: #67391
Assisted-by: Claude, Codex, Mistral
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

Author: UlisesGascon

Makefile

@@ -1572,7 +1572,7 @@ jslint-ci: lint-js-ci
 LINT_CPP_ADDON_DOC_FILES_GLOB = test/addons/??_*/*.cc test/addons/??_*/*.h
 LINT_CPP_ADDON_DOC_FILES = $(wildcard $(LINT_CPP_ADDON_DOC_FILES_GLOB))
 LINT_CPP_EXCLUDE ?=
-LINT_CPP_EXCLUDE += src/node_root_certs.h
+LINT_CPP_EXCLUDE += src/node_root_certs.h src/node_root_certs_distrust.h
 LINT_CPP_EXCLUDE += $(LINT_CPP_ADDON_DOC_FILES)
 # These files were copied more or less verbatim from V8.
 LINT_CPP_EXCLUDE += src/tracing/trace_event_legacy.h src/tracing/trace_event_legacy_inl.h

doc/contributing/maintaining/maintaining-root-certs.md

@@ -8,6 +8,15 @@ The certificates come from Mozilla, specifically NSS's `certdata.txt` file.
 The PEM encodings of the certificates are converted to C strings, and committed
 in `src/node_root_certs.h`.
 
+Mozilla keeps some roots in its store but distrusts TLS server certificates
+they issue after a given date (`CKA_NSS_SERVER_DISTRUST_AFTER` in
+`certdata.txt`). Those dates are committed in `src/node_root_certs_distrust.h`,
+generated by `tools/mk-root-certs-distrust.mjs`, and enforced by the
+certificate verify callback in `src/crypto/crypto_context.cc`. A date Mozilla
+publishes between NSS releases can be added by hand to the `kDistrustAfter`
+table in that file until the next root certificate update brings it into the
+generated header.
+
 ## When to update
 
 Root certificates should be updated sometime after Mozilla makes an NSS release,
@@ -21,8 +30,15 @@ the root certificates, including:
 * Downloading `certdata.txt` from Mozilla's source control repository.
 * Running `tools/mk-ca-bundle.pl` to convert the certificates and generate
   `src/node_root_certs.h`.
-* Using `git diff-files` to determine which certificate have been added and/or
-  removed.
+* Running `tools/mk-root-certs-distrust.mjs` to generate
+  `src/node_root_certs_distrust.h` from the same `certdata.txt`.
+* Using `git diff-files` to determine which certificates and distrust-after
+  dates have been added and/or removed.
+
+The `root-certificates` job in `.github/workflows/tools.yml` runs this script
+weekly and opens a pull request with everything it changed, including the
+regenerated `src/node_root_certs_distrust.h`, so no manual step is needed to
+keep the distrust-after dates in sync.
 
 Manual instructions are included in the following collapsed section.
 
@@ -74,7 +90,15 @@ the nodejs/node repository.
    ./mk-ca-bundle.pl -v 2>_after
    ```
 
-   Confirm that `../src/node_root_certs.h` was updated.
+   Confirm that `../src/node_root_certs.h` was updated. Then regenerate the
+   distrust-after table from the same `certdata.txt`:
+
+   ```bash
+   ./mk-root-certs-distrust.mjs -v
+   ```
+
+   `test/parallel/test-crypto-root-certs-distrust.js` fails when
+   `src/node_root_certs_distrust.h` is out of date with `certdata.txt`.
 
    Determine what changes were made by diffing the before and after files:
 

node.gyp

@@ -304,6 +304,7 @@
       'src/node_report.h',
       'src/node_revert.h',
       'src/node_root_certs.h',
+      'src/node_root_certs_distrust.h',
       'src/node_sea.h',
       'src/node_shadow_realm.h',
       'src/node_snapshotable.h',

src/crypto/crypto_context.cc

@@ -1444,9 +1444,8 @@ constexpr SpkiHash kBlockedSPKIs[] = {
 // server chain through one of these keys and the leaf certificate's
 // notBefore is after the cutoff, the chain is rejected; certificates issued
 // up to the cutoff keep working. Client certificates are not affected, see
-// CertVerifyCallback. tools/mk-ca-bundle.pl does not carry this attribute
-// into node_root_certs.h, so the dates are maintained here. The cutoff is
-// the last valid second, as UTC seconds since the epoch.
+// CertVerifyCallback. The cutoff is the last valid second, as UTC seconds
+// since the epoch.
 //
 // Node.js has no Certificate Transparency checking, so unlike Firefox it
 // cannot detect a backdated notBefore. The same limitation applied to the
@@ -1456,6 +1455,18 @@ struct DistrustAfter {
   time_t cutoff;
 };
 
+// Dates from tools/certdata.txt, generated by tools/mk-root-certs-distrust.mjs
+// together with node_root_certs.h on every root certificate update.
+constexpr DistrustAfter kDistrustAfterBundled[] = {
+#include "node_root_certs_distrust.h"  // NOLINT(build/include_order)
+    // Sentinel so that the array is never empty. A cutoff of 0 is skipped.
+    {{}, 0},
+};
+
+// Dates maintained by hand: ones Mozilla published after the certdata.txt
+// snapshot in the tree, which move to the generated table with the next root
+// certificate update, and the test fixture. Duplicating a generated entry is
+// harmless.
 constexpr DistrustAfter kDistrustAfter[] = {
     // emSign Root CA - G1, cutoff 2026-11-16 23:59:59 UTC.
     // https://bugzilla.mozilla.org/show_bug.cgi?id=2089115
@@ -1466,14 +1477,6 @@ constexpr DistrustAfter kDistrustAfter[] = {
       0x61, 0xd1, 0x19, 0xe9, 0xab, 0x8d, 0x30, 0xf1, 0x1c, 0xc3, 0x21,
       0xd0, 0xa3, 0x7f, 0xa4, 0x1f, 0x0d, 0xf2, 0x84, 0xe0, 0x1c},
      1794873599},  // $ date -u -d @1794873599 = 2026-11-16 23:59:59 UTC
-    // Izenpe.com, cutoff 2026-04-15 23:59:59 UTC.
-    // CKA_NSS_SERVER_DISTRUST_AFTER in tools/certdata.txt
-    // 2530cc8e98321502bad96f9b1fba1b099e2d299e0f4548bb914f363bc0d4531f
-    // C=ES, O=IZENPE S.A., CN=Izenpe.com
-    {{0x95, 0x2c, 0x20, 0x39, 0xc0, 0x24, 0x3e, 0xb5, 0x15, 0xdd, 0x73,
-      0xd8, 0x3f, 0xc3, 0x64, 0x31, 0x84, 0x87, 0x4f, 0xeb, 0x08, 0x62,
-      0xa9, 0x83, 0x77, 0x31, 0xed, 0x9b, 0x47, 0x42, 0xe1, 0x7a},
-     1776297599},  // $ date -u -d @1776297599 = 2026-04-15 23:59:59 UTC
     // Autoridad de Certificacion Firmaprofesional CIF A62634068 (2014 root),
     // cutoff 2026-08-06 07:01:00 UTC.
     // CKA_NSS_SERVER_DISTRUST_AFTER in Mozilla's certdata.txt, newer than the
@@ -1536,15 +1539,24 @@ SpkiCheck CheckDistrustAfter(X509* cert, X509* leaf) {
   if (cert == nullptr || leaf == nullptr) return SpkiCheck::kAllowed;
   SpkiHash digest;
   if (!HashSPKI(cert, &digest)) return SpkiCheck::kError;
-  for (const auto& entry : kDistrustAfter) {
-    if (digest != entry.spki) continue;
+  auto check = [&](const DistrustAfter& entry) {
+    if (entry.cutoff == 0 || digest != entry.spki) return SpkiCheck::kAllowed;
     time_t cutoff = entry.cutoff;
     // X509_cmp_time returns 1 when notBefore is later than cutoff, -1 when
     // earlier or equal, and 0 when the time could not be parsed. A leaf
     // issued exactly at the cutoff second is therefore still accepted.
     int cmp = X509_cmp_time(X509_get0_notBefore(leaf), &cutoff);
     if (cmp == 0) return SpkiCheck::kError;
     if (cmp > 0) return SpkiCheck::kBlocked;
+    return SpkiCheck::kAllowed;
+  };
+  for (const auto& entry : kDistrustAfterBundled) {
+    SpkiCheck result = check(entry);
+    if (result != SpkiCheck::kAllowed) return result;
+  }
+  for (const auto& entry : kDistrustAfter) {
+    SpkiCheck result = check(entry);
+    if (result != SpkiCheck::kAllowed) return result;
   }
   return SpkiCheck::kAllowed;
 }

src/node_root_certs_distrust.h

@@ -0,0 +1,21 @@
+// This file is generated by tools/mk-root-certs-distrust.mjs from
+// tools/certdata.txt. Do not edit it by hand; rerun the script instead.
+//
+// Each entry is a root in node_root_certs.h that Mozilla keeps in its store
+// but distrusts for TLS server certificates issued after the given date
+// (CKA_NSS_SERVER_DISTRUST_AFTER): the SHA-256 of the root's
+// SubjectPublicKeyInfo and the last valid second as UTC seconds since the
+// epoch. The entries initialize kDistrustAfterBundled in
+// src/crypto/crypto_context.cc.
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+/* Izenpe.com */
+// Distrust after 2026-04-15 23:59:59 UTC
+// 2530cc8e98321502bad96f9b1fba1b099e2d299e0f4548bb914f363bc0d4531f
+    {{0x95, 0x2c, 0x20, 0x39, 0xc0, 0x24, 0x3e, 0xb5, 0x15, 0xdd, 0x73,
+      0xd8, 0x3f, 0xc3, 0x64, 0x31, 0x84, 0x87, 0x4f, 0xeb, 0x08, 0x62,
+      0xa9, 0x83, 0x77, 0x31, 0xed, 0x9b, 0x47, 0x42, 0xe1, 0x7a},
+     1776297599},
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

test/parallel/test-crypto-root-certs-distrust.js

@@ -0,0 +1,36 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// src/node_root_certs_distrust.h is generated from tools/certdata.txt by
+// tools/mk-root-certs-distrust.mjs. This test regenerates it into a temporary
+// directory and checks that the committed header is up to date, so that a
+// root-certificate update that brings a new CKA_NSS_SERVER_DISTRUST_AFTER
+// date cannot land without the matching table entry.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+
+const root = path.resolve(__dirname, '..', '..');
+const script = path.join(root, 'tools', 'mk-root-certs-distrust.mjs');
+const committed = path.join(root, 'src', 'node_root_certs_distrust.h');
+if (!fs.existsSync(script) || !fs.existsSync(committed))
+  common.skip('source tree not available');
+
+tmpdir.refresh();
+const generated = path.join(tmpdir.path, 'node_root_certs_distrust.h');
+
+const { status, stderr } = spawnSync(process.execPath, [
+  script, '--output', generated,
+], { encoding: 'utf8' });
+assert.strictEqual(status, 0, stderr);
+
+assert.strictEqual(
+  fs.readFileSync(generated, 'utf8'),
+  fs.readFileSync(committed, 'utf8'),
+  'src/node_root_certs_distrust.h is out of date; ' +
+  'run tools/mk-root-certs-distrust.mjs');

tools/dep_updaters/update-root-certs.mjs

@@ -152,6 +152,19 @@ if (values.verbose) {
   console.log(mkCABundleOut);
 }
 
+// Run tools/mk-root-certs-distrust.mjs to generate
+// src/node_root_certs_distrust.h from the same certdata.txt.
+if (values.verbose) {
+  console.log('Running tools/mk-root-certs-distrust.mjs');
+}
+const mkDistrustTool = join(checkoutDir, 'tools', 'mk-root-certs-distrust.mjs');
+const mkDistrustOut = execFileSync(process.execPath,
+                                   [ mkDistrustTool, ...(values.verbose ? [ '-v' ] : []) ],
+                                   opts);
+if (values.verbose) {
+  console.log(mkDistrustOut);
+}
+
 // Determine certificates added and/or removed.
 const certHeaderFile = relative(process.cwd(), join(checkoutDir, 'src', 'node_root_certs.h'));
 const diff = execFileSync('git', [ 'diff-files', '-u', '--', certHeaderFile ], opts);
@@ -163,6 +176,15 @@ const certsRemovedRE = /^-\/\* (.*) \*\//gm;
 const added = [ ...diff.matchAll(certsAddedRE) ].map((m) => m[1]);
 const removed = [ ...diff.matchAll(certsRemovedRE) ].map((m) => m[1]);
 
+// Determine distrust-after dates added and/or removed.
+const distrustHeaderFile = relative(process.cwd(), join(checkoutDir, 'src', 'node_root_certs_distrust.h'));
+const distrustDiff = execFileSync('git', [ 'diff-files', '-u', '--', distrustHeaderFile ], opts);
+if (values.verbose) {
+  console.log(distrustDiff);
+}
+const distrustAdded = [ ...distrustDiff.matchAll(certsAddedRE) ].map((m) => m[1]);
+const distrustRemoved = [ ...distrustDiff.matchAll(certsRemovedRE) ].map((m) => m[1]);
+
 const commitMsg = [
   `crypto: update root certificates to NSS ${version}`,
   '',
@@ -183,6 +205,16 @@ if (removed.length > 0) {
   commitMsg.push(...removed.map((cert) => `- ${cert}`));
   commitMsg.push('');
 }
+if (distrustAdded.length > 0) {
+  commitMsg.push('Distrust-after dates added:');
+  commitMsg.push(...distrustAdded.map((cert) => `- ${cert}`));
+  commitMsg.push('');
+}
+if (distrustRemoved.length > 0) {
+  commitMsg.push('Distrust-after dates removed:');
+  commitMsg.push(...distrustRemoved.map((cert) => `- ${cert}`));
+  commitMsg.push('');
+}
 commitMsg.push(`[0] ${certdataURL}`);
 const delimiter = randomUUID();
 const properties = [