Node fails to start if /etc/ssl is not accessible

Version

24.14.0

Platform

Linux

Subsystem

No response

What steps will reproduce the bug?

mkdir -pm 750 ssl || chmod 750 ssl
docker run --rm -it -v $PWD/ssl:/etc/ssl -u 999:999 node:24.14.0-alpine3.23 node
node: OpenSSL configuration error:
50B22C3DD67E0000:error:8000000D:system library:BIO_new_file:Permission denied:../deps/openssl/openssl/crypto/bio/bss_file.c:67:calling fopen(/etc/ssl/openssl.cnf, rb)

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

It should ignore this error and continue.

What do you see instead?

It quits immediately with fatal error.

Additional information

No response

From what I can tell, this seems consistent with current Node.js behavior rather than an OpenSSL-side bug.

Node loads OpenSSL configuration during startup, and in this case the configuration load failure appears to be treated as fatal:

node/src/node.cc

Lines 1176 to 1187 in 8ccbe8e

    
           OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, settings); 
        
           OPENSSL_INIT_free(settings); 
        
           if (ERR_peek_error() != 0) { 
        
             // XXX: ERR_GET_REASON does not return something that is 
        
             // useful as an exit code at all. 
        
             result->exit_code_ = 
        
                 static_cast<ExitCode>(ERR_GET_REASON(ERR_peek_error())); 
        
             result->early_return_ = true; 
        
             result->errors_.emplace_back("OpenSSL configuration error:\n" + 
        
                                          GetOpenSSLErrorString()); 
        
             return result;

The CLI docs also describe startup loading of the default OpenSSL configuration file (openssl.cnf), which can be changed via OPENSSL_CONF or --openssl-config, but they do not provide a startup option to skip config loading entirely:
https://nodejs.org/api/cli.html#openssl-shared-config

If different behavior is desired, that would likely be a Node.js behavior change request rather than an OpenSSL bug.

This issue has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

Still relevant.

src: don't fail startup on unreadable OpenSSL config

src: hint at OPENSSL_CONF when the OpenSSL config fails to load

doc: document that an empty OPENSSL_CONF skips config loading

Navigation Menu

Repository navigation

Node fails to start if /etc/ssl is not accessible #62230

Version

Platform

Subsystem

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior? Why is that the expected behavior?

What do you see instead?

Additional information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, settings);
	OPENSSL_INIT_free(settings);

	if (ERR_peek_error() != 0) {
	// XXX: ERR_GET_REASON does not return something that is
	// useful as an exit code at all.
	result->exit_code_ =
	static_cast<ExitCode>(ERR_GET_REASON(ERR_peek_error()));
	result->early_return_ = true;
	result->errors_.emplace_back("OpenSSL configuration error:\n" +
	GetOpenSSLErrorString());
	return result;

Node fails to start if /etc/ssl is not accessible #62230

Description

Version

Platform

Subsystem

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior? Why is that the expected behavior?

What do you see instead?

Additional information

Activity

inoway46 commented on Mar 14, 2026

khalidsaidi commented on Mar 25, 2026

github-actions commented on Jul 20, 2026

orgads commented on Aug 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions