Repository navigation
test: send SNI in CA certificate test - #66835
Merged
Merged
Conversation
Set servername when connecting to www.nodejs.org so the server selects its certificate for that hostname. Without SNI, it returns a certificate that does not cover www.nodejs.org, and the test fails before exercising CA handling. The nightly internet test is failing with this error [1]. Reproduce the certificate mismatch without Node.js: openssl s_client -connect www.nodejs.org:443 -noservername \ -verify_hostname www.nodejs.org -verify_return_error </dev/null This reports "verify error:num=62:Hostname mismatch". Replacing -noservername with -servername www.nodejs.org succeeds. [1]: https://github.com/nodejs/node/actions/runs/39084453901 Signed-off-by: Tamir Duberstein <tamird@gmail.com> Assisted-by: Codex
nodejs-github-bot
added
needs-ci
Contributor
|
Welcome to Node.js, and thank you for your first contribution! Before review, please take a moment to read:
Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal. |
tamird
added a commit
to tamird/gvisor
that referenced
this pull request
Oct 18, 2026
Link the retained runtime-image patch to nodejs/node#66835 so its upstream status can be tracked. The patch hunk and image recipe are unchanged.
panva
approved these changes
Oct 22, 2026
panva
added
fast-track
Contributor
|
Fast-track has been requested by @panva. Please 👍 to approve. |
github-actions
Bot
removed
the
request-ci
Collaborator
richardlau
approved these changes
Oct 22, 2026
marco-ippolito
approved these changes
Oct 22, 2026
Member
|
FWIW this was probably caused by new certificates which have replaced the old certificates that were due to expire tomorrow. cc @ryanaslett as an FYI. I'd prefer to adapt the test than broaden the certificate. |
aduh95
removed
the
fast-track
Collaborator
panva
added
the
commit-queue
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #66835 +/- ##
==========================================
- Coverage 90.50% 89.86% -0.64%
==========================================
Files 797 797
Lines 277793 277793
Branches 53366 53234 -132
==========================================
- Hits 251405 249645 -1760
- Misses 16801 18438 +1637
- Partials 9587 9710 +123 🚀 New features to boost your workflow:
|
Member
|
Thank you for noticing and fixing this @tamird, also congratulations on your first contribution. The PR is now in the commit queue and will land on |
Contributor
Author
|
Thanks all! Credit goes to the LLMs :) |
Collaborator
|
Landed in 727e0ca |
nodejs-github-bot
removed
the
commit-queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Set servername when connecting to www.nodejs.org so the server selects its certificate for that hostname. Without SNI, it returns a certificate that does not cover www.nodejs.org, and the test fails before exercising CA handling. The nightly internet test is failing with this error 1.
Reproduce the certificate mismatch without Node.js:
This reports "verify error:num=62:Hostname mismatch". Replacing -noservername with -servername www.nodejs.org succeeds.