Allow to disable the default ca trust completely

[mdeknowis]

Is your feature request related to a problem? Please describe.
Currently there are only two options regarding the default ca trust used by nodejs

• --use-bundled-ca (default) - Using the hardcoded ca trust: https://github.com/nodejs/node/blob/master/src/node_root_certs.h
• --use-openssl-ca - Using the openssl default ca trust

So there is no out of the box chance to disable the default trust.
According to #4175 (comment) you have to override it manually

https.globalAgent.options.ca = [];

Describe the solution you'd like

From security and operation perspective it would be even better per default not having any trust cas at all, but that would be a huge, breaking change.

So at least an option like --use-no-ca would be very helpful here

[bnoordhuis]

It's not a difficult change to make but I think it needs more justification.

With TLS, you need to trust something. Completely disabling the default CA store means passing { ca: [ /* ... */ ] } explicitly everywhere.

When/why would you want that and is using a preload module (with -r) that sets https.globalAgent.options.ca = [] an acceptable substitute?

[mdeknowis]

@bnoordhuis I think -r https.globalAgent.options.ca = [] could be a sufficient solution.
We are using currently NODE_EXTRA_CA_CERTS. As our customers need full control over the trust store, we have to disable the default trust store and have to ensure, that only the cert are allowed, which are configured by the Op team.

[bnoordhuis]

@nodejs/crypto Thoughts? For https there's a simple workaround, but not e.g. tls.connect().

[github-actions]

There has been no activity on this feature request for 5 months and it is unlikely to be implemented. It will be closed 6 months after the last non-automated comment.

For more information on how the project manages feature requests, please consult the feature request management document.

[github-actions]

There has been no activity on this feature request and it is being closed. If you feel closing this issue is not the right thing to do, please leave a comment.

For more information on how the project manages feature requests, please consult the feature request management document.