src: hint at OPENSSL_CONF when the OpenSSL config fails to load

OpenSSL is initialized with CONF_MFLAGS_IGNORE_MISSING_FILE, so a
missing configuration file does not prevent Node.js from starting.
That flag only covers ENOENT and ENOTDIR though, so a file that exists
but cannot be opened is still fatal. Running in a container where
/etc/ssl is not accessible to the current user aborts startup with an
error that gives no way out:

  OpenSSL configuration error:
  ...:BIO_new_file:Permission denied:...fopen(/etc/ssl/openssl.cnf, rb)

There is a way out: OpenSSL skips config loading entirely when
OPENSSL_CONF is set to an empty value. Say so in the error message,
along with the options that select a different file, and document the
empty value.

Refs: #62230
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com>

Author: orgads

doc/api/cli.md

@@ -4262,6 +4262,11 @@ added: v6.11.0
 Load an OpenSSL configuration file on startup. The file can be used as part of
 a [FIPS mode][] configuration.
 
+If the variable is set to an empty value, no configuration file is loaded. This
+is useful when the default configuration file cannot be read, for example when
+it is not accessible to the user Node.js runs as, which is otherwise a fatal
+error on startup.
+
 If the [`--openssl-config`][] command-line option is used, the environment
 variable is ignored.
 

src/node.cc

@@ -1235,8 +1235,16 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       result->exit_code_ =
           static_cast<ExitCode>(ERR_GET_REASON(ERR_peek_error()));
       result->early_return_ = true;
-      result->errors_.emplace_back("OpenSSL configuration error:\n" +
-                                   GetOpenSSLErrorString());
+      // CONF_MFLAGS_IGNORE_MISSING_FILE above only covers a missing file, so a
+      // configuration file that exists but cannot be read, e.g. when /etc/ssl
+      // is not accessible to the current user, ends up here. Point at the ways
+      // to select another file or skip loading one.
+      // Refs: https://github.com/nodejs/node/issues/62230
+      result->errors_.emplace_back(
+          "OpenSSL configuration error:\n" + GetOpenSSLErrorString() +
+          "Use OPENSSL_CONF or --openssl-config to load a different "
+          "configuration file, or set OPENSSL_CONF to an empty value to start "
+          "without one.");
       return result;
     }
 #else  // OPENSSL_VERSION_MAJOR < 3

test/parallel/test-openssl-unreadable-config.js

@@ -0,0 +1,41 @@
+'use strict';
+
+// A default OpenSSL configuration file that cannot be read is fatal, but the
+// error says how to get past it, and an empty OPENSSL_CONF does get past it.
+// Refs: https://github.com/nodejs/node/issues/62230
+
+const common = require('../common');
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+if (!common.isLinux)
+  common.skip('linux only');
+if (process.config.variables.node_shared_openssl)
+  common.skip('shared openssl may read a different configuration file');
+
+// Replace /etc/ssl with an empty tmpfs in a private mount namespace, where
+// openssl.cnf is a symlink loop: opening it then fails with ELOOP instead of
+// ENOENT, which OpenSSL ignores on its own. The namespace goes away with the
+// process, so the host /etc/ssl is left alone.
+const setup = 'mount -t tmpfs tmpfs /etc/ssl && ln -s openssl.cnf /etc/ssl/openssl.cnf';
+
+if (spawnSync('unshare', ['-Urm', 'sh', '-c', setup]).status !== 0)
+  common.skip('cannot set up an unprivileged user and mount namespace');
+
+function run(env) {
+  return spawnSync(
+    'unshare',
+    ['-Urm', 'sh', '-c', `${setup} && exec "$0" -p 42`, process.execPath],
+    { encoding: 'utf8', env: { ...process.env, ...env } });
+}
+
+const failed = run({});
+assert.notStrictEqual(failed.status, 0);
+assert.match(failed.stderr, /OpenSSL configuration error/);
+assert.match(failed.stderr, /OPENSSL_CONF/);
+
+const skipped = run({ OPENSSL_CONF: '' });
+assert.strictEqual(skipped.status, 0);
+assert.strictEqual(skipped.stdout.trim(), '42');