fix(tls): don't drop Mozilla roots when NODE_EXTRA_CA_CERTS is set on win32

Passing an explicit `connect.ca` to undici replaces Node's default trust
store entirely (Mozilla roots + NODE_EXTRA_CA_CERTS), it does not merge.
The previous change made win32 (and any platform where no system bundle
matched) return only the extra CA, dropping every public root CA — so
any public HTTPS endpoint failed with UNABLE_TO_GET_ISSUER_CERT_LOCALLY.

Narrow the extra-CA merge to the case where a system bundle was already
found (i.e. an explicit `ca` override is already happening). When no
system bundle is found, return `null` so Node's default trust store —
which already honors NODE_EXTRA_CA_CERTS — handles TLS.

Addresses maintainer review on #152.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: 2 people

__tests__/unit/tls-config.test.ts

@@ -29,14 +29,14 @@ async function runTests() {
     assert.ok(certs === null || typeof certs === 'string');
   }, results);
 
-  await testFunction('getSystemCACerts returns null on Windows unless NODE_EXTRA_CA_CERTS is set', () => {
+  await testFunction('getSystemCACerts returns null on Windows even when NODE_EXTRA_CA_CERTS is set', () => {
+    // On Windows, no system bundle is detected and we deliberately return
+    // null so Node's default trust store (Mozilla roots + NODE_EXTRA_CA_CERTS)
+    // handles TLS — passing the extra CA as an explicit `ca` would replace
+    // that store and drop the public roots.
     if (process.platform === 'win32') {
       const certs = getSystemCACerts();
-      if (process.env.NODE_EXTRA_CA_CERTS) {
-        assert.ok(typeof certs === 'string' && certs.length > 0, 'extra CA should be returned on Windows when NODE_EXTRA_CA_CERTS is set');
-      } else {
-        assert.equal(certs, null);
-      }
+      assert.equal(certs, null, 'win32 always returns null; extra CA flows through Node default path');
     } else {
       const certs = getSystemCACerts();
       assert.ok(certs === null || (typeof certs === 'string' && certs.length > 0));
@@ -84,17 +84,32 @@ async function runTests() {
     assert.equal(touched, false, 'win32 skips system bundle discovery and only reads the extra CA path');
   }, results);
 
-  await testFunction('getSystemCACerts honors NODE_EXTRA_CA_CERTS on win32 (skips system bundle loop)', () => {
-    const reads: string[] = [];
+  await testFunction('getSystemCACerts returns null on win32 even with NODE_EXTRA_CA_CERTS (no system bundle → defer to Node default)', () => {
+    let touched = false;
     const certs = getSystemCACerts({
       platformName: 'win32',
-      fileExists: () => { throw new Error('system bundle path should not be probed on win32'); },
-      readFile: (p) => { reads.push(p); return PEM; },
+      fileExists: () => { touched = true; return true; },
+      readFile: () => { touched = true; return PEM; },
       caPaths: ['/should/not/be/read'],
       extraCaPath: '/opt/extra.pem',
     });
-    assert.equal(certs, PEM, 'win32 returns the extra CA bundle');
-    assert.deepEqual(reads, ['/opt/extra.pem'], 'only the extra CA path is read on win32');
+    assert.equal(certs, null, 'win32 defers to Node default trust store; extra CA is honored via NODE_EXTRA_CA_CERTS at the Node level, not by overriding ca');
+    assert.equal(touched, false, 'no bundle paths are read on win32; NODE_EXTRA_CA_CERTS is handled by Node itself');
+  }, results);
+
+  await testFunction('getSystemCACerts returns null when no system bundle is found even if NODE_EXTRA_CA_CERTS is set', () => {
+    // Mirrors the win32 case on a minimal Linux container: no CA_BUNDLE_PATHS
+    // match, but NODE_EXTRA_CA_CERTS is set. Returning null lets Node's
+    // default trust store (Mozilla + extra) handle TLS, instead of replacing
+    // it with the extra CA alone and dropping public roots.
+    const certs = getSystemCACerts({
+      platformName: 'linux',
+      fileExists: () => false,
+      readFile: () => { throw new Error('should not be called'); },
+      caPaths: ['/nope/a.crt', '/nope/b.crt'],
+      extraCaPath: '/opt/extra.pem',
+    });
+    assert.equal(certs, null, 'no system bundle → defer to Node default; do not override ca with extra alone');
   }, results);
 
   await testFunction('getSystemCACerts returns the first readable bundle', () => {

src/tls-config.ts

@@ -35,13 +35,17 @@ export interface CACertDeps {
  * Reads system CA certificates from well-known bundle paths, plus an optional
  * user-provided extra bundle pointed to by `NODE_EXTRA_CA_CERTS`.
  *
- * On Windows there is no universal CA bundle path, so only the extra bundle
- * (if any) is returned. On other platforms the first readable system bundle
- * wins and the extra bundle is appended.
+ * On Windows (and on any platform where no system bundle is found) this
+ * returns `null`, so callers pass no explicit `ca` to undici and Node's
+ * default trust store — Mozilla roots plus `NODE_EXTRA_CA_CERTS` — is used.
+ * This is intentional: passing an explicit `connect.ca` *replaces* the
+ * default trust store entirely, which would drop both the Mozilla roots and
+ * the extra CA unless we re-merged them ourselves.
  *
- * The extra bundle is folded in here because undici's `connect.ca` option,
- * when set, overrides Node's default CA handling and would otherwise ignore
- * `NODE_EXTRA_CA_CERTS` — which the built-in `https` module does honor.
+ * On Linux/macOS when a system bundle *is* found, the system bundle is
+ * returned with the extra bundle appended. Here an explicit `ca` is already
+ * being set (overriding the default path), so folding in the extra bundle is
+ * required to keep `NODE_EXTRA_CA_CERTS` honored in that case.
  */
 export function getSystemCACerts(deps: CACertDeps = {}): string | null {
   const {
@@ -55,8 +59,8 @@ export function getSystemCACerts(deps: CACertDeps = {}): string | null {
 
   const bundles: string[] = [];
 
-  // Windows has no universal CA bundle path; skip auto-detection but still
-  // honor NODE_EXTRA_CA_CERTS below (undici does not read it natively).
+  // Windows has no universal CA bundle path; skip auto-detection. Node's
+  // default trust store (Mozilla + NODE_EXTRA_CA_CERTS) handles Windows.
   if (platformName !== "win32") {
     for (const caPath of caPaths) {
       if (fileExists(caPath)) {
@@ -71,7 +75,11 @@ export function getSystemCACerts(deps: CACertDeps = {}): string | null {
     }
   }
 
-  if (extraCaPath) {
+  // Only fold in the extra CA when a system bundle already forces an explicit
+  // `ca` override. If no system bundle was found, returning `null` here lets
+  // Node's default trust store — which already includes NODE_EXTRA_CA_CERTS —
+  // handle validation, instead of replacing it with the extra CA alone.
+  if (extraCaPath && bundles.length > 0) {
     try {
       bundles.push(readFile(extraCaPath));
     } catch {