Tony Gies 705646f2f7 tls: read the peer certificate chain without consuming it ...

X509Certificate::GetPeerCert() built the certificate objects by deleting
entries from the stack returned by SSL_get_peer_cert_chain(), which is
owned by the SSL session. The first read emptied it, so any later read
by getPeerCertificate() or getPeerX509Certificate(), on either peer, saw
a truncated chain or nothing. Copy each issuer with X509_dup instead and
leave the session's stack untouched.

onServerSocketSecure() only called getPeerX509Certificate() to check
whether a peer certificate was present, building the whole chain on
every server handshake; that is what first exposed the destructive read.
Use a lightweight hasPeerCertificate() binding for the presence check.

Signed-off-by: Tony Gies <tgies@tgies.net>
PR-URL: https://github.com/nodejs/node/pull/65602
Fixes: https://github.com/nodejs/node/issues/65579
Refs: https://github.com/nodejs/node/pull/64677
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

2026-08-31 18:04:06 +00:00

..

common.js

tls: avoid external memory leak on invalid protocol versions

2025-10-26 16:29:49 +00:00

secure-context.js

lib: use validateArray for array arguments

2026-08-09 11:55:05 +00:00

wrap.js

tls: read the peer certificate chain without consuming it

2026-08-31 18:04:06 +00:00