fix: forward string env vars to cluster.fork() so NODE_EXTRA_CA_CERTS etc. actually apply - #6156
Open
kiboook wants to merge 1 commit into
Open
Conversation
… etc. actually apply
cluster.fork() was only called with {pm2_env, windowsHide}, so none of
the app's own env vars exist as real env vars in the worker at boot
time - they only get set later, after pm2_env is parsed. That's too
late for anything Node reads once during TLS bootstrap, NODE_EXTRA_CA_CERTS
being the most common case people run into with a private CA.
Fixes Unitech#5919. A narrow fix for just this one var was proposed back in
string-typed key in env_copy gets forwarded as a real env var too,
alongside pm2_env. Non-string values are skipped on purpose, that's
what pm2_env/[object Object] leak issue Unitech#6073 was about.
Reproduced locally with a private CA + a small HTTPS server: cluster
mode failed with UNABLE_TO_VERIFY_LEAF_SIGNATURE even though
process.env.NODE_EXTRA_CA_CERTS was correctly set inside the worker,
which confirms it's a timing issue and not a missing value. Added
test/programmatic/issue_5919_node_extra_ca_certs.mocha.js, which fails
without this patch and passes with it. Existing cluster/env tests
(including issue_6073) still pass.
kiboook
force-pushed
the
fix/cluster-node-extra-ca-certs-v3
branch
from
September 9, 2026 11:16
adb6236 to
8c440a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #5919.
God.nodeAppcallscluster.fork({pm2_env: JSON.stringify(env_copy), windowsHide: true}), so the only real env vars a cluster worker gets at boot arepm2_envandwindowsHide. Everything the app itself set -NODE_EXTRA_CA_CERTSbeing the one people keep hitting - only shows up later, once pm2 parsespm2_envand assigns it ontoprocess.env. That's after Node has already done its one-time TLS bootstrap read, so it's too late for anything Node only reads at startup.Fork mode doesn't have this problem since it passes the real env through directly, which is exactly why "works in fork mode, breaks in cluster mode" is the recurring symptom in #5919.
#3117 proposed fixing this for
NODE_EXTRA_CA_CERTSspecifically back in 2017 but never got merged. This does the same thing but generally: every string-typed key inenv_copygets forwarded as a real env var tocluster.fork(), not just that one. Non-string values are deliberately skipped, since that's what the[object Object]leak in #6073 was about and I didn't want to reopen that.To confirm this was actually the bug and not something else, I set up a private CA + a small HTTPS server locally and pointed
NODE_EXTRA_CA_CERTSat the CA cert. Cluster mode failed withUNABLE_TO_VERIFY_LEAF_SIGNATURE- andprocess.env.NODE_EXTRA_CA_CERTSwas correct inside the worker the whole time, which is what pointed me at the timing issue instead of a missing-value issue.Added
test/programmatic/issue_5919_node_extra_ca_certs.mocha.jsdoing the same thing (private CA generated on the fly, real HTTPS request from inside a cluster worker). It fails on master and passes with this patch. Ran it alongsideissue_6073_object_env,cluster.mocha.js,filter_env.mocha.jsandenv_switching.jsand all still pass.