crypto: X509Certificate#checkIssued() should return a boolean (#31571)
Fixes #31570
## Problem
`X509Certificate.prototype.checkIssued(otherCert)` must return a
**boolean** in Node.js. Bun returned the issuer certificate object on
success and `undefined` on failure.
```js
import { X509Certificate } from "node:crypto";
import { readFileSync } from "node:fs";
const cert = new X509Certificate(readFileSync("ca1-cert.pem")); // self-signed
cert.checkIssued(cert); // Node: true | Bun (before): <the certificate>
typeof cert.checkIssued(cert); // Node: "boolean" | Bun (before): "object"
```
## Cause
`jsX509CertificateProtoFuncCheckIssued` in
`src/jsc/bindings/JSX509CertificatePrototype.cpp` copied the return
pattern from `checkHost`/`checkEmail`/`checkIP`, where returning the
validated value (or `undefined`) is the correct Node contract:
```cpp
if (!check) return JSValue::encode(jsUndefined());
return JSValue::encode(issuer);
```
But `checkIssued` returns a boolean in Node. The underlying
`JSX509Certificate::checkIssued` already returns a C++ `bool` correctly
— only the JS wrapper's return value was wrong. This has been the case
since the method was first implemented (#16173); it is not a regression.
## Fix
Return the boolean directly:
```cpp
auto check = thisObject->checkIssued(globalObject, issuer);
RETURN_IF_EXCEPTION(scope, {});
return JSValue::encode(jsBoolean(check));
```
## Verification
Added coverage in `test/js/node/crypto/x509-subclass.test.ts` (the
existing `node:crypto` X509Certificate test file) asserting `typeof ===
"boolean"` for:
- `agent1.checkIssued(ca1)` → `true` (issued by)
- `ca1.checkIssued(ca1)` → `true` (self-signed — the reported case)
- `agent1.checkIssued(ca2)` → `false` (unrelated issuer)
- `agent1.checkIssued(agent1)` → `false` (not self-signed)
- invalid argument throws `ERR_INVALID_ARG_TYPE`
The tests fail against the current release (returning
`"object"`/`"undefined"`) and pass with this change. The official
Node.js compat test `test/js/node/test/parallel/test-crypto-x509.js`
still passes. R
robobun committed
efc26a1be0413d71d5210715ea22ce8ed485ab16
Parent: cb4a5c6
Committed by GitHub <noreply@github.com>
on 5/29/2026, 5:50:16 PM