René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Intermediate certs don't work with SNICallback","articleBody":"If I give key, cert and ca via options field to https.createServer the whole key chain is returned on connection (correct behaviour). If I try to do the same via SNICallback it is not possible to set whole key chain.\n\nExample code:\n\n```\nvar https = require(\"https\");\nvar fs = require(\"fs\");\nvar tls = require(\"tls\");\n\nvar o = {\n    key: fs.readFileSync(\"example.com.key\"),\n    cert: fs.readFileSync(\"example.com.crt\"),\n    ca: fs.readFileSync(\"intermediate.crt\")\n};\n\nvar context = tls.createSecureContext(o);\nvar options = {\n    SNICallback: function(servername, cb) {\n        return cb(null, context);\n    },\n\n    ca: o.ca\n};\n\nhttps.createServer(options, function(req, res) {\n    res.writeHead(200);\n    res.end(\"hello world\\n\");\n}).listen(8000);\n```\n\nNow try to connect via openssl:\n\n```\nopenssl s_client -servername example.com -connect localhost:8000\n```\n\nExpected and real behaviour is `Verify return code: 0 (OK)`.\n\nIf I remove the ca in options map like this\n\n```\nvar options = {\n    SNICallback: function(servername, cb) {\n        return cb(null, context);\n    }\n};\n```\n\nand rerun openssl client the return code is `Verify return code: 21 (unable to verify the first certificate)`which indicates that not the whole key chain is returned.\nThe expected behaviour is `Verify return code: 0 (OK)` as the ca field is given to `tls.createSecureContext`.\n\nThis occures in io.js 3.x and Node.js 4.0.0.\n","author":{"url":"https://github.com/fastner","@type":"Person","name":"fastner"},"datePublished":"2015-09-09T14:36:53.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/2772/node/issues/2772"}