crypto: add X.509 generation with CSR support by panva · Pull Request #67245 · nodejs/node

panva · 2026-11-04T10:42:27Z

Expose callback-based generateX509Certificate() and synchronous generateX509CertificateSync(), producing X509Certificate objects for self-signed and issuer-signed X.509 v3 certificates. Accept grouped distinguished names or exact subject DER, public keys, serial numbers, validity dates, and an explicit signing digest. Reuse crypto.sign() key inputs and RSA options, including OpenSSL STORE-backed keys.

A PKCS#10 request can supply the subject and public key instead. Require a synchronous selectExtensions callback to accept, replace, or amend the requested extensions. Verify the request signature before signing the certificate, in the selected sync or async mode.

Provide typed Basic Constraints, Key Usage, Extended Key Usage, SAN, SKI, and AKI, plus arbitrary raw extensions. Add none implicitly and leave raw extension semantics to the caller. Copy mutable inputs before queueing asynchronous work. Certificate trust and CA authorization remain the caller's responsibility.

This is PR 4 out of 4 in an X.509 series addressing #48730 and #51169.

Expose callback-based generateX509Certificate() and synchronous generateX509CertificateSync(), producing X509Certificate objects for self-signed and issuer-signed X.509 v3 certificates. Accept grouped distinguished names or exact subject DER, public keys, serial numbers, validity dates, and an explicit signing digest. Reuse crypto.sign() key inputs and RSA options, including OpenSSL STORE-backed keys. A PKCS#10 request can supply the subject and public key instead. Require a synchronous selectExtensions callback to accept, replace, or amend the requested extensions. Verify the request signature before signing the certificate, in the selected sync or async mode. Provide typed Basic Constraints, Key Usage, Extended Key Usage, SAN, SKI, and AKI, plus arbitrary raw extensions. Add none implicitly and leave raw extension semantics to the caller. Copy mutable inputs before queueing asynchronous work. Certificate trust and CA authorization remain the caller's responsibility. Fixes: nodejs#51169 Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Require a supported backend when selecting the BIT STRING length capability. Reject other backends at compile time, matching the surrounding checks used to catch unsupported OpenSSL backports. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-11-04T10:42:34Z

Review requested:

@nodejs/crypto
@nodejs/gyp
@nodejs/security-wg

codecov · 2026-11-04T13:01:59Z

Codecov Report

❌ Patch coverage is 79.58188% with 293 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.63%. Comparing base (3b209b2) to head (a44ae0e).
⚠️ Report is 67 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_x509_gen.cc	68.26%	102 Missing and 149 partials ⚠️
lib/internal/crypto/x509_generation.js	93.47%	39 Missing and 1 partial ⚠️
src/crypto/crypto_x509_gen.h	33.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #67245      +/-   ##
==========================================
- Coverage   90.68%   90.63%   -0.06%     
==========================================
  Files         797      800       +3     
  Lines      279367   280794    +1427     
  Branches    53737    54083     +346     
==========================================
+ Hits       253344   254493    +1149     
- Misses      16319    16443     +124     
- Partials     9704     9858     +154

Files with missing lines	Coverage Δ
lib/crypto.js	`94.56% <100.00%> (+0.22%)`	⬆️
lib/internal/crypto/sig.js	`98.46% <100.00%> (+<0.01%)`	⬆️
src/crypto/crypto_util.h	`68.53% <ø> (ø)`
src/crypto/crypto_x509.cc	`71.52% <100.00%> (-0.20%)`	⬇️
src/crypto/crypto_x509.h	`65.21% <ø> (ø)`
src/node_crypto.cc	`81.81% <ø> (ø)`
src/crypto/crypto_x509_gen.h	`33.33% <33.33%> (ø)`
lib/internal/crypto/x509_generation.js	`93.47% <93.47%> (ø)`
src/crypto/crypto_x509_gen.cc	`68.26% <68.26%> (ø)`

... and 28 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

mcollina

lgtm

nodejs-github-bot · 2026-11-09T16:24:08Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78928/

nodejs-github-bot · 2026-11-09T18:37:38Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78933/

nodejs-github-bot · 2026-11-11T10:46:26Z

Landed in 77e6379...2336a1f

Expose callback-based generateX509Certificate() and synchronous generateX509CertificateSync(), producing X509Certificate objects for self-signed and issuer-signed X.509 v3 certificates. Accept grouped distinguished names or exact subject DER, public keys, serial numbers, validity dates, and an explicit signing digest. Reuse crypto.sign() key inputs and RSA options, including OpenSSL STORE-backed keys. A PKCS#10 request can supply the subject and public key instead. Require a synchronous selectExtensions callback to accept, replace, or amend the requested extensions. Verify the request signature before signing the certificate, in the selected sync or async mode. Provide typed Basic Constraints, Key Usage, Extended Key Usage, SAN, SKI, and AKI, plus arbitrary raw extensions. Add none implicitly and leave raw extension semantics to the caller. Copy mutable inputs before queueing asynchronous work. Certificate trust and CA authorization remain the caller's responsibility. Fixes: #51169 Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #67245 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Require a supported backend when selecting the BIT STRING length capability. Reject other backends at compile time, matching the surrounding checks used to catch unsupported OpenSSL backports. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #67245 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Expose callback-based generateX509Certificate() and synchronous generateX509CertificateSync(), producing X509Certificate objects for self-signed and issuer-signed X.509 v3 certificates. Accept grouped distinguished names or exact subject DER, public keys, serial numbers, validity dates, and an explicit signing digest. Reuse crypto.sign() key inputs and RSA options, including OpenSSL STORE-backed keys. A PKCS#10 request can supply the subject and public key instead. Require a synchronous selectExtensions callback to accept, replace, or amend the requested extensions. Verify the request signature before signing the certificate, in the selected sync or async mode. Provide typed Basic Constraints, Key Usage, Extended Key Usage, SAN, SKI, and AKI, plus arbitrary raw extensions. Add none implicitly and leave raw extension semantics to the caller. Copy mutable inputs before queueing asynchronous work. Certificate trust and CA authorization remain the caller's responsibility. Fixes: #51169 Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #67245 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Require a supported backend when selecting the BIT STRING length capability. Reject other backends at compile time, matching the surrounding checks used to catch unsupported OpenSSL backports. Assisted-by: Codex Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #67245 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Notable changes: child_process: * (SEMVER-MINOR) add subprocess.timedOut (Marco) #66639 crypto: * (SEMVER-MINOR) make X.509 inspection guards explicit (Filip Skokan) #67245 * (SEMVER-MINOR) add X.509 generation with CSR support (Filip Skokan) #67245 dns: * (SEMVER-MINOR) coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599 doc: * add efekrskl to collaborators (Efe Karasakal) #67376 * add Philipp Dunkel to contributors (Philipp Dunkel) #67378 * add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377 http: * (SEMVER-MINOR) batch body spans per parser execute (Guilherme Araújo) #67187 sea: * (SEMVER-MINOR) generate a compile cache for the VFS modules (Matteo Collina) #66768 worker: * (SEMVER-MINOR) preload streams into startup snapshot (Matteo Collina) #66311 PR-URL: #67415

panva added 2 commits November 4, 2026 10:52

nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Nov 4, 2026

panva requested a review from pimterry November 4, 2026 10:43

panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Nov 4, 2026

panva requested a review from mcollina November 4, 2026 10:43

panva added 2 commits November 4, 2026 11:57

fixup! crypto: add X.509 generation with CSR support

e1037ac

fixup! crypto: add X.509 generation with CSR support

a44ae0e

panva mentioned this pull request Nov 6, 2026

crypto: X509Certificate returns "Bad time value" instead of throwing for an unreadable validity time #67285

Open

mcollina approved these changes Nov 9, 2026

View reviewed changes

panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Nov 9, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Nov 9, 2026

panva added the resume-ci Add this label to resume the latest eligible Jenkins CI run on a PR with an approving review. label Nov 9, 2026

github-actions Bot removed the resume-ci Add this label to resume the latest eligible Jenkins CI run on a PR with an approving review. label Nov 9, 2026

sxa mentioned this pull request Nov 10, 2026

test-perf-hooks-histogram-external-memory failures on node-test-comit-plinux #67374

Open

panva added semver-minor PRs that contain new features and should be released in the next minor version. baking-for-lts PRs whose changes need more time before an LTS backport. commit-queue PRs queued for automated landing through the Commit Queue. labels Nov 11, 2026

nodejs-github-bot added the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Nov 11, 2026

nodejs-github-bot closed this Nov 11, 2026

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Nov 11, 2026

nodejs-github-bot removed the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Nov 11, 2026

panva deleted the x509-generation branch November 11, 2026 11:03

panva mentioned this pull request Nov 11, 2026

test: fix X.509 generation with OpenSSL 4.1 FIPS #67409

Closed

github-actions Bot mentioned this pull request Nov 11, 2026

2026-11-12, Version 27.0.0-alpha.0.1.0 (Alpha) #67415

Open

Navigation Menu

Repository navigation

crypto: add X.509 generation with CSR support - #67245

crypto: add X.509 generation with CSR support#67245
panva wants to merge 4 commits into
nodejs:mainfrom
panva:x509-generation

panva commented Nov 4, 2026

Uh oh!

nodejs-github-bot commented Nov 4, 2026

Uh oh!

codecov Bot commented Nov 4, 2026 •

edited

Loading

Uh oh!

mcollina left a comment

Uh oh!

nodejs-github-bot commented Nov 9, 2026

Uh oh!

nodejs-github-bot commented Nov 9, 2026

Uh oh!

nodejs-github-bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

panva commented Nov 4, 2026

Uh oh!

nodejs-github-bot commented Nov 4, 2026

Uh oh!

codecov Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Nov 9, 2026

Uh oh!

nodejs-github-bot commented Nov 9, 2026

Uh oh!

nodejs-github-bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Nov 4, 2026 •

edited

Loading