`node:crypto` PEM key import method unexpected/undocumented behaviours

[panva]

All methods that cover importing PEM of any kind (crypto.createPublicKey(pem), crypto.createPrivateKey(pem), crypto.createPrivateKey(x509), new crypto.X509Certificate(x509)) have the following undocumented, possibly unexpected, behaviour.

const pkcs8 = `
This isn't part of PKCS#8

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiyvo0X+VQ0yIrOaN
nlrnUclopnvuuMfoc8HHly3505OhRANCAAQWUcdZ8uTSAsFuwtNy4KtsKqgeqYxg
l6kwL5D4N3pEGYGIDjV69Sw0zAt43480WqJv7HCL0mQnyqFmSrxj8jMa
-----END PRIVATE KEY-----

NEITHER IS THIS

-----BEGIN PRIVATE KEY-----
THis is clearly invalid
-----END PRIVATE KEY-----
`

crypto.createPrivateKey(pkcs8) // <- this successfully imports the first detected key

All these methods ignore everything outside of the first encountered PEM. Is this expected behaviour ?

[panva]

cc @nodejs/crypto

[bnoordhuis]

Is this expected behaviour ?

Yes. Google doesn't turn up good references but openssl works that way since time immemorial, as far as I'm aware.

[panva]

OpenSSL's behaviours don't necessarily have to translate to Node.js API behaviours.

[bnoordhuis]

You're right they don't have to, but they have, and now here we are. :-)

[bnoordhuis]

@panva unless you have anything to add, can I go and close this?

[panva]

I don't think of this as resolved, the behaviour seems undesirable or at the very least undocumented.

[panva]

cc @tniessen

[tniessen]

Ben is right, this has always been a quirk of OpenSSL. We might at least document this in order to resolve this issue. We use various APIs to interact with PEM, so we'd have to carefully look up what APIs have what quirks around PEM.

[bnoordhuis]

As quirks go this one is pretty inconsequential, arguably not noteworthy enough to encumber the documentation with yet additional trivia.

[panva]

As quirks go this one is pretty inconsequential, arguably not noteworthy enough to encumber the documentation with yet additional trivia.

I agree that for public/private keys this is inconsequential, but how about passing a cert chain to createPublicKey or new X509Certificate()?

[bnoordhuis]

Doesn't seem like a problem to me.