Electron 28: ordering of session.setCertificateVerifyProc callbacks remains undefined

Answer

Electron 28 does not define a deterministic execution order for multiple session.setCertificateVerifyProc callbacks registered across sessions. For a single request, Electron normally invokes the verify proc registered on the session that owns that request; it does not automatically chain or order procs from unrelated sessions. The --ignore-certificate-errors flag bypasses certificate validation and generally suppresses custom verify-proc handling for ignored errors, so ordering is moot rather than reordered when the flag is present. Electron 28 documents no precedence between setCertificatePinnedKeys and setCertificateVerifyProc; neither should be assumed to override the other.

Confirmed facts versus likely explanation

Item	Status	Detail
Cross-session callback order	Undocumented	Electron 28 API docs specify no priority, queue, or deterministic chain.
Per-request handler	Likely session-scoped	The request's owning session normally supplies the verify proc; other sessions' procs are not automatically invoked together.
--ignore-certificate-errors	Likely suppression	Flag bypasses validation and generally suppresses custom proc handling for ignored errors; verify against your build.
Pinned keys vs. verify proc	Undocumented	No documented precedence; test both enabled together before relying on either.

Verification steps

1. Register a uniquely logging verify proc on each session using session.setCertificateVerifyProc.
2. Trigger the same certificate-handled request and record which proc runs and its return value.
3. Repeat with --ignore-certificate-errors present and absent to confirm whether the proc is invoked or suppressed.
4. Enable setCertificatePinnedKeys with a verify proc, then test valid and pinned-mismatch certificates to observe whether the proc is still called and whether its decision is honored.

const { session } = require('electron');
const proc = (request, callback) => {
  console.log('verify-proc called:', request.url);
  callback(0);
};
session.fromPartition('persist:name').setCertificateVerifyProc(proc);

Assumptions and uncertainty

• This covers Electron's main-process session API, not OS-level hibernation or unrelated Hibernate APIs.
• Behavior observed in Electron 28 may not apply to later Electron releases.
• --ignore-certificate-errors can mask validation failures and prevent verify-proc logging, complicating debugging.

Do not build security logic on callback execution order; it is undefined and may change between Electron versions.

Missing diagnostic detail: confirm the exact Electron build and Chromium version in use, because certificate-handling internals can shift between patch releases. Provide that if you need a version-specific ruling.