Skip to content

docs: document NODE_EXTRA_CA_CERTS (2.8) #3081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bartlomieju merged 3 commits into from
May 20, 2026
Merged

docs: document NODE_EXTRA_CA_CERTS (2.8) #3081

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1dfd45e
docs: document NODE_EXTRA_CA_CERTS env var (2.8)
lunadogbot Apr 29, 2026
57b2378
Merge 2.8 into docs/2.8-node-extra-ca-certs
bartlomieju May 20, 2026
bd12012
docs: add DENO_AUDIT_PERMISSIONS and NODE_EXTRA_CA_CERTS to cli/env_v…
bartlomieju May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion runtime/reference/cli/env_variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,18 @@
---
last_modified: 2024-10-07
last_modified: 2026-05-20
title: "Configuring Deno behavior"
---

There are several environment variables which can impact the behavior of Deno:

### DENO_AUDIT_PERMISSIONS

Audit every permission access (allowed or denied). Set to a file path to write a
JSONL audit log, or to the literal value `otel` to emit each access as an
OpenTelemetry log record via the configured exporter. See
[permissions](/runtime/fundamentals/security/#permission-flags) for the field
set and the OTel attribute names.

### DENO_AUTH_TOKENS

A list of authorization tokens which can be used to allow Deno to access remote
Expand Down Expand Up @@ -86,6 +94,14 @@ permission to read the environment variables by checking the value of
Indicates hosts which should bypass the proxy set in the other environment
variables. See the [Proxies](#proxies) section for more information.

### NODE_EXTRA_CA_CERTS

Path to a PEM file with extra certificate authorities. Loaded at the root
certificate store level, so the certs are honored by `fetch()`,
`Deno.connectTls()`, and the Node compat APIs (`node:https`, `node:tls`).
Available in Deno 2.8+. Missing or invalid files emit a warning rather than
failing, matching Node.js semantics.

### NPM_CONFIG_REGISTRY

The npm registry to use when loading modules via
Expand Down
47 changes: 24 additions & 23 deletions runtime/reference/env_variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,26 +138,27 @@ examples.

The Deno runtime has these special environment variables.

| name | description |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DENO_AUTH_TOKENS | A semi-colon separated list of bearer tokens and hostnames to use when fetching remote modules from private repositories<br />(e.g. `abcde12345@deno.land;54321edcba@github.com`) |
| DENO_TLS_CA_STORE | Comma-separated list of order dependent certificate stores.<br />Possible values: `system`, `mozilla`. Defaults to `mozilla`. |
| DENO_CERT | Load certificate authority from PEM encoded file |
| DENO_COVERAGE_DIR | Set the directory for collecting coverage profile data. This option only works for [`deno test` subcommand](/runtime/reference/cli/test/). |
| DENO_DIR | Set the cache directory |
| DENO_INSTALL_ROOT | Set deno install's output directory (defaults to `$HOME/.deno/bin`) |
| DENO_REPL_HISTORY | Set REPL history file path History file is disabled when the value is empty <br />(defaults to `$DENO_DIR/deno_history.txt`) |
| DENO_NO_PACKAGE_JSON | Disables auto-resolution of `package.json` |
| DENO_NO_PROMPT | Set to disable permission prompts on access<br />(alternative to passing `--no-prompt` on invocation) |
| DENO_NO_UPDATE_CHECK | Set to disable checking if a newer Deno version is available |
| DENO_V8_FLAGS | Set V8 command line options |
| DENO_JOBS | Number of parallel workers used for the `--parallel` flag with the test subcommand.<br />Defaults to number of available CPUs. |
| DENO_KV_ACCESS_TOKEN | Personal access token used when connecting to Deno KV databases (for example via [`Deno.openKv`](/api/deno/~/Deno.openKv) or `@deno/kv` with a KV Connect URL). |
| DENO_AUDIT_PERMISSIONS | Audit every permission access. Set to a file path to write JSONL, or to the literal value `otel` to emit OpenTelemetry log records via the configured OTel exporter. See [permissions audit](/runtime/fundamentals/security/#permission-flags) for the field set. |
| DENO_WEBGPU_TRACE | Path to a directory to output a [WGPU trace](https://github.com/gfx-rs/wgpu/pull/619) to when using the WebGPU API |
| DENO_WEBGPU_BACKEND | Select the backend WebGPU will use, or a comma separated list of backends in order of preference. Possible values are `vulkan`, `dx12`, `metal`, or `opengl` |
| HTTP_PROXY | Proxy address for HTTP requests (module downloads, fetch) |
| HTTPS_PROXY | Proxy address for HTTPS requests (module downloads, fetch) |
| NPM_CONFIG_REGISTRY | URL to use for the npm registry. |
| NO_COLOR | Set to disable color |
| NO_PROXY | Comma-separated list of hosts which do not use a proxy (module downloads, fetch) |
| name | description |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DENO_AUTH_TOKENS | A semi-colon separated list of bearer tokens and hostnames to use when fetching remote modules from private repositories<br />(e.g. `abcde12345@deno.land;54321edcba@github.com`) |
| DENO_TLS_CA_STORE | Comma-separated list of order dependent certificate stores.<br />Possible values: `system`, `mozilla`. Defaults to `mozilla`. |
| DENO_CERT | Load certificate authority from PEM encoded file |
| NODE_EXTRA_CA_CERTS | Path to a PEM file with extra certificate authorities. Loaded at the root certificate store level, so the certs are honored by `fetch()`, `Deno.connectTls()`, and Node compat APIs (`node:https`, `node:tls`). Available in Deno 2.8+. Missing or invalid files emit a warning rather than failing, matching Node.js. |
| DENO_COVERAGE_DIR | Set the directory for collecting coverage profile data. This option only works for [`deno test` subcommand](/runtime/reference/cli/test/). |
| DENO_DIR | Set the cache directory |
| DENO_INSTALL_ROOT | Set deno install's output directory (defaults to `$HOME/.deno/bin`) |
| DENO_REPL_HISTORY | Set REPL history file path History file is disabled when the value is empty <br />(defaults to `$DENO_DIR/deno_history.txt`) |
| DENO_NO_PACKAGE_JSON | Disables auto-resolution of `package.json` |
| DENO_NO_PROMPT | Set to disable permission prompts on access<br />(alternative to passing `--no-prompt` on invocation) |
| DENO_NO_UPDATE_CHECK | Set to disable checking if a newer Deno version is available |
| DENO_V8_FLAGS | Set V8 command line options |
| DENO_JOBS | Number of parallel workers used for the `--parallel` flag with the test subcommand.<br />Defaults to number of available CPUs. |
| DENO_KV_ACCESS_TOKEN | Personal access token used when connecting to Deno KV databases (for example via [`Deno.openKv`](/api/deno/~/Deno.openKv) or `@deno/kv` with a KV Connect URL). |
| DENO_AUDIT_PERMISSIONS | Audit every permission access. Set to a file path to write JSONL, or to the literal value `otel` to emit OpenTelemetry log records via the configured OTel exporter. See [permissions audit](/runtime/fundamentals/security/#permission-flags) for the field set. |
| DENO_WEBGPU_TRACE | Path to a directory to output a [WGPU trace](https://github.com/gfx-rs/wgpu/pull/619) to when using the WebGPU API |
| DENO_WEBGPU_BACKEND | Select the backend WebGPU will use, or a comma separated list of backends in order of preference. Possible values are `vulkan`, `dx12`, `metal`, or `opengl` |
| HTTP_PROXY | Proxy address for HTTP requests (module downloads, fetch) |
| HTTPS_PROXY | Proxy address for HTTPS requests (module downloads, fetch) |
| NPM_CONFIG_REGISTRY | URL to use for the npm registry. |
| NO_COLOR | Set to disable color |
| NO_PROXY | Comma-separated list of hosts which do not use a proxy (module downloads, fetch) |