crypto: improve system certificate enumeration logic on macOS

[deepak1556]

In VSCode we are looking to adopt the builtin system certificate api over our current implementation https://github.com/microsoft/vscode-proxy-agent/blob/59cc268f93f52fdfd0c7ac1f25aadefae74965fb/src/index.ts#L1189-L1201

As part of the rollout we observed a drop in certificate count (some machines also got 0 certs) from the builtin api and I was validating the cases with additional error telemetry https://gist.github.com/deepak1556/ef6c141e0cd3f5381cbf6f37fc590acf. It confirmed the failures are on the valid path, all the certs had no explicit trust settings and were getting filtered under the fallback SecTrustEvaluateWithError path.

The changes in this PR are some cleanups and some misalign in logic with chromium implementation noticed while working on the error api. Each commit has additional context on the change.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.05%. Comparing base (ae1c0e4) to head (4f69241).
⚠️ Report is 346 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62576      +/-   ##
==========================================
+ Coverage   89.79%   90.05%   +0.26%     
==========================================
  Files         697      714      +17     
  Lines      215773   225245    +9472     
  Branches    41297    42581    +1284     
==========================================
+ Hits       193749   202847    +9098     
- Misses      14117    14179      +62     
- Partials     7907     8219     +312     

Files with missing lines	Coverage Δ
src/crypto/crypto_context.cc	72.03% <ø> (+0.05%)	⬆️

... and 191 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joyeecheung]

LGTM, thanks. Is it possible to add some tests? We have some integration tests in test/system-ca, see the README there for how to add the certificates and how to clean them up.

(caveat: the tests don't actually run without you doing a local mv test/system-ca/test.cfg.py test/system-ca/testcfg.py, it's currently a weird bug we rely on to not run it in the CI because the CI isn't prepped for this..)

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/72511/

[gurgunday]

lgtm

[deepak1556]

Looks like unrelated CI failures. Seems to have been addressed by 449a93a. Rebasing.

[joyeecheung]

Looks like it got closed by the other vscode PR?

[deepak1556]

Ah missed that, Thanks!

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/72671/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73269/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73381/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/62576
✔  Done loading data for nodejs/node/pull/62576
----------------------------------- PR info ------------------------------------
Title      crypto: improve system certificate enumeration logic on macOS (#62576)
Author     Robo <hop2deep@gmail.com> (@deepak1556)
Branch     deepak1556:robo/cleanup_macos_system_cert_api -> nodejs:main
Labels     crypto, c++, needs-ci
Commits    1
 - crypto: improve system certificate enumeration logic on macOS
Committers 1
 - deepak1556 <hop2deep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62576
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/62576
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 03 Apr 2026 12:29:50 GMT
   ✔  Approvals: 2
   ✔  - Joyee Cheung (@joyeecheung) (TSC): https://github.com/nodejs/node/pull/62576#pullrequestreview-4156240689
   ✔  - Gürgün Dayıoğlu (@gurgunday): https://github.com/nodejs/node/pull/62576#pullrequestreview-4061571023
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-05-11T18:51:34Z: https://ci.nodejs.org/job/node-test-pull-request/73381/
- Querying data for job/node-test-pull-request/73381/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 62576
From https://github.com/nodejs/node
 * branch                  refs/pull/62576/merge -> FETCH_HEAD
✔  Fetched commits as 20e6a54b5525..1fe7f749272a
--------------------------------------------------------------------------------
Auto-merging src/crypto/crypto_context.cc
[main 1a922d2ad7] crypto: improve system certificate enumeration logic on macOS
 Author: deepak1556 <hop2deep@gmail.com>
 Date: Fri Apr 3 20:09:47 2026 +0900
 7 files changed, 310 insertions(+), 28 deletions(-)
 create mode 100644 test/fixtures/keys/expired-root-cert.pem
 create mode 100644 test/fixtures/keys/expired-root-key.pem
 create mode 100644 test/fixtures/keys/selfsigned-no-result-root-cert.pem
 create mode 100644 test/fixtures/keys/selfsigned-no-result-root-key.pem
 create mode 100644 test/system-ca/test-macos-cert-filtering.mjs
   ✔  Patches applied
--------------------------------------------------------------------------------
--------------------------------- New Message ----------------------------------
crypto: improve system certificate enumeration logic on macOS

Fixed macOS default for missing kSecTrustSettingsResult

When kSecTrustSettingsResult is absent from a trust settings dictionary,

Apple specifies kSecTrustSettingsResultTrustRoot as the default value.
Previously, the trust result evaluation (deny check, self-issued check,

TrustAsRoot check) was inside the block that only executed when

kSecTrustSettingsResult was explicitly present. When the key was absent,

the function fell through to return UNSPECIFIED, incorrectly rejecting

self-signed certificates that should have been trusted via the default.
Move the trust result evaluation outside the conditional block so the

default value of kSecTrustSettingsResultTrustRoot flows through the

same code path as explicit values. This aligns with Chromium's

trust_store_mac.cc implementation.


Fix CFRelease leak in IsTrustDictionaryTrustedForPolicy: the

CFDictionaryRef returned by SecPolicyCopyProperties(policy_ref)

was not released when the policy OID matched kSecPolicyAppleSSL.


Deduplicate certificates: SecItemCopyMatching can return the same

certificate from multiple keychains.


Filter expired certificates.


PR-URL: #62576

Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
[main 36bc52c798] crypto: improve system certificate enumeration logic on macOS

Author: deepak1556 <hop2deep@gmail.com>

Date: Fri Apr 3 20:09:47 2026 +0900

7 files changed, 310 insertions(+), 28 deletions(-)

create mode 100644 test/fixtures/keys/expired-root-cert.pem

create mode 100644 test/fixtures/keys/expired-root-key.pem

create mode 100644 test/fixtures/keys/selfsigned-no-result-root-cert.pem

create mode 100644 test/fixtures/keys/selfsigned-no-result-root-key.pem

create mode 100644 test/system-ca/test-macos-cert-filtering.mjs

✖  36bc52c79834e2350a4008ad76b8b11f95a64223

✔  0:0      no Assisted-by metadata                   assisted-by-is-trailer

✔  0:0      no Co-authored-by metadata                co-authored-by-is-trailer

✔  0:0      skipping fixes-url                        fixes-url

✔  0:0      blank line after title                    line-after-title

✔  0:0      line-lengths are valid                    line-length

✔  0:0      metadata is at end of message             metadata-end

✔  26:8     PR-URL is valid.                          pr-url

✔  0:0      reviewers are valid                       reviewers

✖  0:0      Commit must have a "Signed-off-by" trailer signed-off-by

✔  0:0      valid subsystems                          subsystem

✔  0:0      Title is formatted correctly.             title-format

⚠  0:50     Title should be <= 50 columns.            title-length
ℹ  Please fix the commit message and try again.

Please manually ammend the commit message, by running

git commit --amend

Once commit message is fixed, finish the landing command running

git node land --continue

https://github.com/nodejs/node/actions/runs/25699415593

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73389/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73394/

[nodejs-github-bot]

Landed in c363bec