From 54930a297f2150c18d014c7dac994c4e8668264c Mon Sep 17 00:00:00 2001
From: Tamir Duberstein <tamird@gmail.com>
Date: Fri, 16 Oct 2026 23:54:18 +0200
Subject: [PATCH] Send SNI in the Node.js CA certificate test

The CA interaction test connected to www.nodejs.org without sending a
TLS server name. The endpoint returned its default nodejs.org
certificate, which did not cover www.nodejs.org, so hostname verification
failed before the test could check the supplied CA behavior.

Send www.nodejs.org as the server name while preserving the hostname,
certificate verification and all CA assertions. Apply the correction in
the runtime image and include the patched test in its syntax checks.

Assisted-by: Codex
---
 images/runtimes/nodejs22.2.0/Dockerfile.x86_64    |  6 ++++++
 images/runtimes/nodejs22.2.0/tls-servername.patch | 14 ++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 images/runtimes/nodejs22.2.0/tls-servername.patch

diff --git a/images/runtimes/nodejs22.2.0/Dockerfile.x86_64 b/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
index ce47d064eed..b69d1dd5843 100644
--- a/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
+++ b/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
@@ -26,6 +26,12 @@ RUN make -j $(nproc) test-build
 RUN out/Release/node --check test/common/index.js \
   && out/Release/node --check test/parallel/test-http-outgoing-end-cork.js
 
+# Select the certificate for www.nodejs.org in the CA interaction test.
+COPY tls-servername.patch /tmp/tls-servername.patch
+RUN patch -p1 --no-backup-if-mismatch < /tmp/tls-servername.patch \
+  && out/Release/node --check test/internet/test-tls-add-ca-cert.js \
+  && rm -f /tmp/tls-servername.patch
+
 # Including dumb-init emulates the Linux "init" process, preventing the failure
 # of tests involving worker processes.
 ENTRYPOINT ["/usr/bin/dumb-init"]
diff --git a/images/runtimes/nodejs22.2.0/tls-servername.patch b/images/runtimes/nodejs22.2.0/tls-servername.patch
new file mode 100644
index 00000000000..900c8c3f5d5
--- /dev/null
+++ b/images/runtimes/nodejs22.2.0/tls-servername.patch
@@ -0,0 +1,14 @@
+# tls.connect does not send SNI by default, so the server otherwise
+# selects its default certificate instead of the one for www.nodejs.org.
+# https://nodejs.org/api/tls.html#tlsconnectoptions-callback
+# Upstream: https://github.com/nodejs/node/pull/66835
+diff --git a/test/internet/test-tls-add-ca-cert.js b/test/internet/test-tls-add-ca-cert.js
+--- a/test/internet/test-tls-add-ca-cert.js
++++ b/test/internet/test-tls-add-ca-cert.js
+@@ -27,5 +27,6 @@ const caCert = loadPEM('ca1-cert');
+ const opts = {
+   host: 'www.nodejs.org',
++  servername: 'www.nodejs.org',
+   port: 443,
+   rejectUnauthorized: true,
+ };