crypto: support --use-system-ca on Windows

[joyeecheung]

This patch adds support for --use-system-ca on Windows, the
certificates are collected following Chromium's policy,
though the following are left as TODO and out of this patch.

• Support for user-added intermediate certificates
• Support for distrusted certificates

Since those aren't typically supported by other runtimes/tools
either, and what's implemented in this patch is sufficient for
enough use cases already.

Fixes: #51537

---

This PR re-implements #44532 but is based on the support added for macOS in #56599 with the following modifications to match Chromium's policy:

1. We also collect certificates from local machine, enterprise policies and trusted people
2. We check that the extended key usage (if it exists) is suitable for TLS use.

The first commit comes from #56832 to fix a leak from the macOS PR.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/64855/

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.15%. Comparing base (4355b3f) to head (91db2b0).
Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #56833   +/-   ##
=======================================
  Coverage   89.14%   89.15%           
=======================================
  Files         665      665           
  Lines      192846   192846           
  Branches    37147    37144    -3     
=======================================
+ Hits       171916   171926   +10     
- Misses      13696    13703    +7     
+ Partials     7234     7217   -17     

Files with missing lines	Coverage Δ
src/crypto/crypto_context.cc	67.49% <ø> (ø)

... and 27 files with indirect coverage changes

[timja]

Nice work!

What sort of testing have you done on this? - I see the integration test added

I'll look to get someone on windows behind our ZScaler enterprise setup next week to test it.

(and potentially with https://github.com/timja/openjdk-intermediate-ca-reproducer both root -> leaf and root -> intermediate -> leaf, unless you've tested something similar)

[joyeecheung]

What sort of testing have you done on this? - I see the integration test added

So far only the test I modified in test-native-certs.mjs - basically the same as the macOS test, just running it first to see that it fails, then adding that certificate locally to Windows, run the test and see that it works, and removing that certificate. From what I can tell the real-world use cases I have only require the root CA certificates from either local machine or the current users to be trusted. I will try verifying it a bit on my end.

[joyeecheung]

I verified that this works for the environment that I have, which only require the root certificates to be added. I've left the intermediate CAs as a TODO since it seems many other tools do not support it either and is only needed for certain setups.

Fixed the linter complaints. @jasnell can you take a look again? Thanks

[timja]

I verified that this works for the environment that I have, which only require the root certificates to be added. I've left the intermediate CAs as a TODO since it seems many other tools do not support it either and is only needed for certain setups.

Chrome supports it somehow, not quite sure how it does it though, without the intermediate enterprise setups may not work properly as a lot of enterprises are using tools like ZScaler, (or other similar products) where you give the SaaS service an intermediate certificate that is trusted on your devices and then it resigns every certificate for each TLS endpoint you hit.

What tools specifically do you mean aren't supporting it? I expect the JDK is broken, Rust ecosystem generally I find works in this area.

[joyeecheung]

without the intermediate enterprise setups may not work properly as a lot of enterprises are using tools like ZScaler, (or other similar products) where you give the SaaS service an intermediate certificate that is trusted on your devices and then it resigns every certificate for each TLS endpoint you hit.

Yes, I am aware, though this PR only aims to solve the other common case, where you are dealing with services from a organization/company/government that manages the certificates themselves instead of relying on a third-party SaaS. Hence the intermediate certificate use case is left as a TODO. I think that can be done in a follow-up PR instead, similar to the distrust store.

What tools specifically do you mean aren't supporting it?

From what I can tell, every Rust tool using the rustls-native-certs crate (which seems rather popular) would not work with intermediate certificates, because they only query the root certificates from the current user https://github.com/rustls/rustls-native-certs/blob/main/src/windows.rs (if this approach somehow works for the intermediate certificates, then this PR should also just work because this PR does even more than that, though I doubt it does).

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65039/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65048/

[joyeecheung]

Rebased after the leak fix landed. @jasnell can you take a look again? Thanks

[nodejs-github-bot]

Landed in c0953d9