Suggest --use-system-ca when a certificate error occurs

[Aditi-1400]

This change appends a hint suggesting that if the root CA is installed locally, try running with the --use-system-ca flag.
For errors like UNABLE_TO_VERIFY_LEAF_SIGNATURE, DEPTH_ZERO_SELF_SIGNED_CERT, or UNABLE_TO_GET_ISSUER_CERT occur.
This change directs developers toward a secure solution — preventing them from using unsafe workarounds (e.g. disabling TLS verification entirely) that have been discussed in the threads online like the following:

• https://stackoverflow.com/questions/31673587/error-unable-to-verify-the-first-certificate-in-nodejs
• https://stackoverflow.com/questions/36494336/npm-install-error-unable-to-get-local-issuer-certificate
• and https://stackoverflow.com/questions/10888610/ignore-invalid-self-signed-ssl-certificate-in-node-js-with-https-request.

Thanks @joyeecheung for the help :)

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[joyeecheung]

Linter is complaining

ERROR: Please run:

  CLANG_FORMAT_START=$(git merge-base HEAD main) make format-cpp

to format the commits in your branch.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65634/

[jasnell]

Suggested change

	Note: When certificate errors like `UNABLE_TO_VERIFY_LEAF_SIGNATURE`,
	When certificate errors like `UNABLE_TO_VERIFY_LEAF_SIGNATURE`,

[jasnell]

Suggested change

	if (suggest_system_ca)
	reason.append("; if the root CA is installed locally, "
	"try running Node.js with --use-system-ca");
	if (suggest_system_ca) {
	reason.append("; if the root CA is installed locally, "
	"try running Node.js with --use-system-ca");
	}

[jasnell]

Suggested change

	await assert.rejects(makeRequest(port, 3), (err) => {
	assert.strictEqual(err.code, 'DEPTH_ZERO_SELF_SIGNED_CERT');
	return true;
	});
	await assert.rejects(makeRequest(port, 3), {
	code: 'DEPTH_ZERO_SELF_SIGNED_CERT',
	});

[jasnell]

Suggested change

	await assert.rejects(makeRequest(port, 3), (err) => {
	assert.strictEqual(err.code, 'DEPTH_ZERO_SELF_SIGNED_CERT');
	return true;
	});
	await assert.rejects(makeRequest(port, 3), {
	code: 'DEPTH_ZERO_SELF_SIGNED_CERT',
	});

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.21%. Comparing base (a790901) to head (9a60c5e).
Report is 12 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #57362      +/-   ##
==========================================
- Coverage   90.21%   90.21%   -0.01%     
==========================================
  Files         630      630              
  Lines      185304   185315      +11     
  Branches    36266    36276      +10     
==========================================
+ Hits       167171   167178       +7     
- Misses      11084    11086       +2     
- Partials     7049     7051       +2     

Files with missing lines	Coverage Δ
src/crypto/crypto_common.cc	72.91% <100.00%> (+1.17%)	⬆️

... and 29 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65641/