From 1dfd45e5c406bc8918a1c6e548bf9b8f5fcf278d Mon Sep 17 00:00:00 2001
From: Luna <279187109+lunadogbot@users.noreply.github.com>
Date: Wed, 29 Apr 2026 11:46:01 +0000
Subject: [PATCH] docs: document NODE_EXTRA_CA_CERTS env var (2.8)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Adds NODE_EXTRA_CA_CERTS to the special-environment-variables table.
Notes that the certs are honored at the root store level by fetch(),
Deno.connectTls(), and Node compat APIs (node:https, node:tls), and
that missing/invalid files only warn — matching Node.js behavior.
Refs denoland/deno#33148
---
runtime/reference/env_variables.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/runtime/reference/env_variables.md b/runtime/reference/env_variables.md
index 8769046bc..fcf1f377a 100644
--- a/runtime/reference/env_variables.md
+++ b/runtime/reference/env_variables.md
@@ -143,6 +143,7 @@ The Deno runtime has these special environment variables.
| DENO_AUTH_TOKENS | A semi-colon separated list of bearer tokens and hostnames to use when fetching remote modules from private repositories
(e.g. `abcde12345@deno.land;54321edcba@github.com`) |
| DENO_TLS_CA_STORE | Comma-separated list of order dependent certificate stores.
Possible values: `system`, `mozilla`. Defaults to `mozilla`. |
| DENO_CERT | Load certificate authority from PEM encoded file |
+| NODE_EXTRA_CA_CERTS | Path to a PEM file with extra certificate authorities. Loaded at the root certificate store level, so the certs are honored by `fetch()`, `Deno.connectTls()`, and Node compat APIs (`node:https`, `node:tls`). Available in Deno 2.8+. Missing or invalid files emit a warning rather than failing — matching Node.js. |
| DENO_COVERAGE_DIR | Set the directory for collecting coverage profile data. This option only works for [`deno test` subcommand](/runtime/reference/cli/test/). |
| DENO_DIR | Set the cache directory |
| DENO_INSTALL_ROOT | Set deno install's output directory (defaults to `$HOME/.deno/bin`) |