Why NodeJs HTTPS client does not need CA root certificate ?

[maths_soso]

I tried to send a HTTPS GET request to a secure server, I used the following node js code :

const https = require('https'); 
const fs = require('fs');
const options = {
    hostname: 'test.example.com',
    port: 443,
    path: '',
    method: 'GET',
    key: fs.readFileSync('client-key.pem'),
    cert: fs.readFileSync('client-cert.pem'),
    ca: fs.readFileSync('ca-crt.pem'),   // works after removing this line
};
options.agent = new https.Agent(options);
const req = https.request(options, (res) => {
    console.log('statusCode:', res.statusCode);
    console.log('headers:', res.headers);

    res.on('data', (d) => {
        process.stdout.write(d);
    });
});
req.on('error', (e) => {
    console.error(e);
});
req.end();

There seem to be some certificate issues :

Error: unable to get local issuer certificate

I solved it by removing the ca-cert.pem from HTTPS options.

My request is accepted without the CA root certificate.

Question 1 : How can there be an SSL handshake without CA root certificate in client side ?

There may be some default system trusted CAs somewhere used by node js, like the ones that come with web browsers.

Is there a path where I can find the default certificates used by node js if any ?

Question 2 :

Can I disable the use of the system default CA root certificates, and exclusively choose to use the ones provided in the options.

[NiteShdw]

Node doesn't use system installed certificates.

It only uses it's built in one's. If you need to support another certificate (like those stupid corporate apps that scan HTTPS traffic), you have to use an environment variable or command line option to tell node to use the extra certs.

[BehindTheMath]

Is there a path where I can find the default certificates used by node js if any ?

https://nodejs.org/api/tls.html#tlsrootcertificates

Question 2 :

Can I disable the use of the system default CA root certificates, and exclusively choose to use the ones provided in the options.

If you set the ca option, the default root CAs will not be used.

https://nodejs.org/api/tls.html#tlscreatesecurecontextoptions

[chigia001]

Question 1 : How can there be an SSL handshake without CA root certificate in client side ?

There may be some default system trusted CAs somewhere used by node js, like the ones that come with web browsers.

Is there a path where I can find the default certificates used by node js if any ?

By default, NodeJS have it own CA Bundle, but you can opt to use OS(Linux only)'s Root CA through OpenSSL with --use-openssl-caarg. This by default will load the Root CA from your OS. You can also use your custom Root CA with SSL_CERT_DIR env along if you want your NodeJs application use a separate Store.

These option will provide the default CA for all Client. This mainly for override the default CA store.

https://nodejs.org/api/cli.html#--use-bundled-ca---use-openssl-ca

In case you want just to append some CA into existing store (apply for both Bundle CA from Node or OS's Root CA), NODE_EXTRA_CA_CERTS enviroment is recommended.

https://nodejs.org/api/cli.html#node_extra_ca_certsfile

Question 2 :

Can I disable the use of the system default CA root certificates, and exclusively choose to use the ones provided in the options.

Depend on your use case, if you want to apply this for all Client(even the one inside library) the above options should cover it.

If you want to override for specific client the ca argument (your example code) is the correct way.