tls: read the peer certificate chain without consuming it

[tgies]

Server-side getPeerCertificate(true) stopped returning the client certificate's issuer chain in v26.8.0. issuerCertificate became undefined.

The root cause actually predates this regression; X509Certificate::GetPeerCert() walked the stack from SSL_get_peer_cert_chain() with sk_X509_delete(), so the first read destroyed the chain for every later read. #64677 added an internal call to getPeerX509Certificate() in onServerSocketSecure() to detect presence of a certificate, so now the mutating read happens every time.

This changes getPeerX509Certificate() to read the chain non-destructively, copying issuers with X509_dup, and replaces the presence check with a hasPeerCertificate() binding.

Fixes: #65579
Refs: #64677

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/net

[tgies]

BTW, the argument for adding the hasPeerCertificate() binding even after making getPeerX509Certificate() nondestructive is mainly that it's expensive and unnecessary to call getPeerX509Certificate() here anyway. That builds the whole cert chain and the JS X509Certificate wrapper objects on every handshake just so we can test != null.

[tgies]

This was closed in error, sorry.

[panva]

@tgies please fix the first commit message, rebase and force push

[codecov]

Codecov Report

❌ Patch coverage is 77.14286% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.07%. Comparing base (8fe4b64) to head (e39d831).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_x509.cc	73.07%	3 Missing and 4 partials ⚠️
src/crypto/crypto_tls.cc	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65602      +/-   ##
==========================================
- Coverage   90.07%   90.07%   -0.01%     
==========================================
  Files         754      754              
  Lines      256317   256334      +17     
  Branches    48476    48474       -2     
==========================================
+ Hits       230871   230884      +13     
- Misses      16563    16565       +2     
- Partials     8883     8885       +2     

Files with missing lines	Coverage Δ
lib/internal/tls/wrap.js	95.17% <100.00%> (ø)
src/crypto/crypto_tls.h	87.50% <ø> (ø)
src/crypto/crypto_x509.h	52.94% <ø> (ø)
src/crypto/crypto_tls.cc	78.74% <87.50%> (-0.03%)	⬇️
src/crypto/crypto_x509.cc	73.12% <73.07%> (+0.05%)	⬆️

... and 26 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.