test/document TLS authentication, then add support for TRUSTED CERTIFICATE pem headers

[sam-github]

TLS client authentication should be tested, including failure scenarios.

There were tests for a couple success scenarios as side-effects of testing other things, but little coverage for the various ways intermediate and root CAs can be configured.

Support the same PEM certificate formats for the ca: option to
tls.createSecureContext() that are supported by openssl when loading a
CAfile.

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• documentation is changed or added
• commit message follows commit guidelines

[nodejs-github-bot]

@sam-github build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/1733/pipeline

[Trott]

CI: https://ci.nodejs.org/job/node-test-pull-request/19066/

[addaleax]

Should this module maybe rather be in test/common/?

[sam-github]

I don't know. It predates test/common, AFAICT, but perhaps it should have been moved there when test/common was created? Moving it would be a good code-n-learn activity.

[sam-github]

While I was doing some support yesterday for people banging their head against node's tls, I found that node wasn't working with "TRUSTED CERATIFICATE", and @bnoordhuis pointed me towards the root cause.

I pushed the fix onto this PR so I can use the tests to prove it did not used to work, and now it does.

node/deps/openssl/openssl/crypto/x509/by_file.c

Line 93 in 01c5c16

x = PEM_read_bio_X509_AUX(in, NULL, NULL, "");

is what openssl's -CAfile option eventually leads to, so I believe calling PEM_read_bio_X509_AUX() is the right thing for Node.js to do as well.

@addaleax @bnoordhuis PTAL

[sam-github]

Travis failed to find the first commit, as it often does.

ci: https://ci.nodejs.org/job/node-test-pull-request/19097/

[Trott]

Resume Build CI: https://ci.nodejs.org/job/node-test-pull-request/19129/

[bnoordhuis]

Wrap in common.mustCall(...) here and below?

[sam-github]

The common connect() function does that already.

[bnoordhuis]

The linux failures look unrelated but the windows failures do. As to why the connection is being established when it shouldn't, I have no idea.

[sam-github]

ci: https://ci.nodejs.org/job/node-test-pull-request/19141/

[sam-github]

ci: https://ci.nodejs.org/job/node-test-pull-request/19168/

[addaleax]

Resume CI (scheduled): https://ci.nodejs.org/job/node-test-pull-request/19190/

[Trott]

Windows failures on CI are relevant:

https://ci.nodejs.org/job/node-test-binary-windows/22179/COMPILED_BY=vs2017,RUNNER=win10,RUN_SUBSET=3/console

03:11:38 not ok 456 parallel/test-tls-client-auth
03:11:38   ---
03:11:38   duration_ms: 0.239
03:11:38   severity: fail
03:11:38   exitcode: 1
03:11:38   stack: |-
03:11:38     c:\workspace\node-test-binary-windows\test\parallel\test-tls-client-auth.js:152
03:11:38       assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
03:11:38                              ^
03:11:38     
03:11:38     TypeError: Cannot read property 'code' of undefined
03:11:38         at c:\workspace\node-test-binary-windows\test\parallel\test-tls-client-auth.js:152:26
03:11:38         at c:\workspace\node-test-binary-windows\test\common\index.js:346:15
03:11:38         at maybeCallback (c:\workspace\node-test-binary-windows\test\fixtures\tls-connect.js:97:7)
03:11:38         at TLSSocket.<anonymous> (c:\workspace\node-test-binary-windows\test\fixtures\tls-connect.js:68:13)
03:11:38         at TLSSocket.emit (events.js:189:13)
03:11:38         at TLSSocket.onConnectSecure (_tls_wrap.js:1168:10)
03:11:38         at TLSSocket.emit (events.js:189:13)
03:11:38         at TLSSocket._finishInit (_tls_wrap.js:629:8)
03:11:38   ...

[sam-github]

Ah, Windows CRLF... I do not love thee.

ci: https://ci.nodejs.org/job/node-test-pull-request/19314/

[sam-github]

linux failures: https://ci.nodejs.org/job/node-test-commit-linux/23842/

Look like exit code test failures, not related to TLS.

re-ci: https://ci.nodejs.org/job/node-test-commit-linux/23845/

[sam-github]

more aix & linux exit code and CLI syntax failures, retry: https://ci.nodejs.org/job/node-test-commit/24172/

[sam-github]

The only failures were test-cli-syntax.js, which is flaky. I'm re-running ci, but I think this is landable.

re-ci: https://ci.nodejs.org/job/node-test-commit/24210/

[sam-github]

Landed in 83ec33b...2e4a163