SIGN IN SIGN UP
oven-sh / bun UNCLAIMED

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

0 0 150 Rust

node:crypto: uppercase X509 serialNumber and modulus hex to match Node (#31519)

`X509Certificate.serialNumber`,
`.toLegacyObject().serialNumber`/`.modulus`, and
`tls.getPeerCertificate().serialNumber`/`.modulus` were **lowercase**
hex in Bun, but Node/OpenSSL (and `openssl x509 -serial`) emit
**uppercase** — breaking literal serial-string cert pinning /
allowlists.

BoringSSL's `BN_bn2hex`/`BN_print` emit lowercase; OpenSSL (which Node's
`ncrypto` targets) emits uppercase. Bun already uppercases the
fingerprint path but missed serialNumber/modulus. ASCII-uppercase them
in `computeSerialNumber` and the two `toLegacyObject` modulus sites
(`getPeerCertificate` routes through the same C++ `toLegacyObject`, so
it's covered). `exponent` is left lowercase (Node emits it lowercase
too), and `BignumPointer::toHex` is untouched (its other callers
re-parse via `parseInt`).

Updates the existing tests that asserted the old lowercase
(`node-tls-connect`/`node-tls-server`, regression #21274) to the
uppercase values Node produces, and adds an X509 uppercase-hex
regression test. Not a port regression — 1.3.14 is also lowercase; Node
is the reference.

---------

Co-authored-by: robobun <117481402+robobun@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
A
Alistair Smith committed
3a79bd746b11601c9db970b608c73f0b9f96ac81
Parent: 6162fb2
Committed by GitHub <noreply@github.com> on 5/29/2026, 7:34:47 PM