Support loading certificates with Node.js (#80)

Author: chrmarti

CHANGELOG.md

@@ -1,6 +1,9 @@
 # Change Log
 Notable changes will be documented here.
 
+## [0.36.0]
+- Support loading certificates with Node.js ([microsoft/vscode-proxy-agent#80](https://github.com/microsoft/vscode-proxy-agent/pull/80))
+
 ## [0.35.0]
 - Flush proxy cache when network interfaces changed ([microsoft/vscode-proxy-agent#79](https://github.com/microsoft/vscode-proxy-agent/pull/79))
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@vscode/proxy-agent",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "NodeJS http(s) agent implementation for VS Code",
   "main": "out/index.js",
   "types": "out/index.d.ts",
@@ -27,6 +27,9 @@
     "url": "https://github.com/microsoft/vscode-proxy-agent/issues"
   },
   "homepage": "https://github.com/microsoft/vscode-proxy-agent",
+  "engines": {
+    "node": ">=22.15.0"
+  },
   "dependencies": {
     "@tootallnate/once": "^3.0.0",
     "agent-base": "^7.0.1",
@@ -38,7 +41,7 @@
   },
   "devDependencies": {
     "@types/debug": "^4.1.9",
-    "@types/node": "^20.8.4",
+    "@types/node": "^22.18.10",
     "typescript": "^5.2.2"
   },
   "scripts": {

package.json

@@ -70,6 +70,7 @@ export interface ProxyAgentParams {
 	isAdditionalFetchSupportEnabled: () => boolean,
 	addCertificatesV1: () => boolean,
 	addCertificatesV2: () => boolean,
+	loadSystemCertificatesFromNode: () => boolean | undefined;
 	loadAdditionalCertificates(): Promise<string[]>;
 	lookupProxyAuthorization?: LookupProxyAuthorization;
 	log: Log;
@@ -522,17 +523,18 @@ function patchTlsConnect(params: ProxyAgentParams, original: typeof tls.connect)
 			if (!options.secureContext) {
 				options.secureContext = tls.createSecureContext(options);
 			}
-			if (!_certificates) {
+			const certificates = _certs.get(!!params.loadSystemCertificatesFromNode())?.result;
+			if (!certificates) {
 				params.log.trace('ProxyResolver#tls.connect waiting for existing socket connect');
 				options.socket.once('connect' , () => {
 					params.log.trace('ProxyResolver#tls.connect got existing socket connect - adding certs');
-					for (const cert of _certificates || []) {
+					for (const cert of _certs.get(!!params.loadSystemCertificatesFromNode())?.result || []) {
 						options!.secureContext!.context.addCACert(cert);
 					}
 				});
 			} else {
 				params.log.trace('ProxyResolver#tls.connect existing socket already connected - adding certs');
-				for (const cert of _certificates) {
+				for (const cert of certificates) {
 					options!.secureContext!.context.addCACert(cert);
 				}
 			}
@@ -877,28 +879,41 @@ function addCertificatesToOptionsV1(params: ProxyAgentParams, addCertificatesV1:
 	}
 }
 
-let _certificatesPromise: Promise<string[]> | undefined;
-let _certificates: string[] | undefined;
+const _certs = new Map<boolean, { promise: Promise<string[]>; result: string[] | undefined }>();
 export async function getOrLoadAdditionalCertificates(params: ProxyAgentParams) {
-	if (!_certificatesPromise) {
-		_certificatesPromise = (async () => {
-			return _certificates = await params.loadAdditionalCertificates();
-		})();
+	const loadFromNode = !!params.loadSystemCertificatesFromNode();
+	if (!_certs.has(loadFromNode)) {
+		const cert: { promise: Promise<string[]>; result: string[] | undefined } = {
+			promise: (async () => {
+				const result = await params.loadAdditionalCertificates();
+				return cert!.result = result; // need to await before accessing cert.
+			})(),
+			result: undefined
+		};
+		_certs.set(loadFromNode, cert);
 	}
-	return _certificatesPromise;
+	return _certs.get(loadFromNode)!.promise;
 }
 
 export interface CertificateParams {
+	loadSystemCertificatesFromNode: () => boolean | undefined;
 	log: Log;
 }
 
 let _systemCertificatesPromise: Promise<string[]> | undefined;
 export async function loadSystemCertificates(params: CertificateParams) {
+	if (!!params.loadSystemCertificatesFromNode?.()) { // Checking if function exists for backward compatibility.
+		const start = Date.now();
+		const systemCerts = tls.getCACertificates('system');
+		params.log.debug(`ProxyResolver#loadSystemCertificates from Node.js count (${Date.now() - start}ms)`, systemCerts.length);
+		return systemCerts;
+	}
 	if (!_systemCertificatesPromise) {
 		_systemCertificatesPromise = (async () => {
 			try {
+				const start = Date.now();
 				const certs = await readSystemCertificates();
-				params.log.debug('ProxyResolver#loadSystemCertificates count', certs.length);
+				params.log.debug(`ProxyResolver#loadSystemCertificates count (${Date.now() - start}ms)`, certs.length);
 				const now = Date.now();
 				const filtered = certs
 					.filter(cert => {
@@ -923,8 +938,7 @@ export async function loadSystemCertificates(params: CertificateParams) {
 }
 
 export function resetCaches() {
-	_certificatesPromise = undefined;
-	_certificates = undefined;
+	_certs.clear();
 	_systemCertificatesPromise = undefined;
 }
 

src/index.ts

@@ -13,7 +13,7 @@
   "devDependencies": {
     "@types/kerberos": "^1.1.2",
     "@types/mocha": "5.2.5",
-    "@types/node": "^20.8.4",
+    "@types/node": "^22.18.10",
     "kerberos": "^2.0.1",
     "mocha": "10.8.2",
     "ts-node": "9.1.1",

tests/test-client/package-lock.json

@@ -230,30 +230,39 @@ describe('Direct client', function () {
 			assert.strictEqual(err?.message, 'self-signed certificate');
 		}
 	});
-	it('should use ca agent option 2', async function () {
-		try {
-			vpa.resetCaches(); // Allows loadAdditionalCertificates to run again.
-			const params = {
-				...directProxyAgentParamsV1,
-				loadAdditionalCertificates: async () => [
-					...await vpa.loadSystemCertificates({ log: console }),
-				],
-			};
-			const { resolveProxyWithRequest: resolveProxy } = vpa.createProxyResolver(params);
-			const patchedHttps: typeof https = {
-				...https,
-				...vpa.createHttpPatch(params, https, resolveProxy),
-			} as any;
-			await testRequest(patchedHttps, {
-				hostname: 'test-https-server',
-				path: '/test-path',
-				_vscodeTestReplaceCaCerts: true,
-				agent: new https.Agent({ ca }),
-			});
-		} finally {
-			vpa.resetCaches(); // Allows loadAdditionalCertificates to run again.
-		}
-	});
+	for (const loadSystemCertificatesFromNode of [
+		() => true,
+		() => false,
+		undefined as any as (() => boolean), // Test backward compatibility
+	]) {
+		it('should use ca agent option 2', async function () {
+			try {
+				vpa.resetCaches(); // Allows loadAdditionalCertificates to run again.
+				const params = {
+					...directProxyAgentParamsV1,
+					loadAdditionalCertificates: async () => [
+						...await vpa.loadSystemCertificates({
+							loadSystemCertificatesFromNode,
+							log: console,
+						}),
+					],
+				};
+				const { resolveProxyWithRequest: resolveProxy } = vpa.createProxyResolver(params);
+				const patchedHttps: typeof https = {
+					...https,
+					...vpa.createHttpPatch(params, https, resolveProxy),
+				} as any;
+				await testRequest(patchedHttps, {
+					hostname: 'test-https-server',
+					path: '/test-path',
+					_vscodeTestReplaceCaCerts: true,
+					agent: new https.Agent({ ca }),
+				});
+			} finally {
+				vpa.resetCaches(); // Allows loadAdditionalCertificates to run again.
+			}
+		});
+	}
 	it('should prefer ca agent option', async function () {
 		const { resolveProxyWithRequest: resolveProxy } = vpa.createProxyResolver(directProxyAgentParamsV1);
 		const patchedHttps: typeof https = {