Post

fyi for people on bun, SSL_CERT_FILE + empty SSL_CERT_DIR, --use-openssl-ca, BUN_OPTIONS, NODE_OPTIONS, overmounting /etc/ssl/certs, and tls.setDefaultCACertificates() all still trust the compromised certs so have fun. only thing you can do is `fetch(url, { tls: { ca } })` till bun updates

some correction, if you mount a bundle with explicit rejection entries and then set SSL_CERT_FILE it should reject the compromised CAs

0 reposts5 likes