setCertificateVerifyProc Error Code Coverage Gap

What error codes are forwarded

Electron's webContents.setCertificateVerifyProc receives an integer errorCode from Chromium's net::Error enumeration. The numeric values are identical on Windows, macOS and Linux because the underlying Chromium stack is shared.

• 0 – success, certificate validated.
• -200 to -299 – certificate and TLS errors. Examples: -200 ERR_CERT_COMMON_NAME_INVALID, -201 ERR_CERT_DATE_INVALID, -202 ERR_CERT_AUTHORITY_INVALID.
• -100 to -199 – network and DNS errors. Examples: -105 ERR_NAME_NOT_RESOLVED, -110 ERR_CONNECTION_TIMED_OUT, -113 ERR_CONNECTION_FAILED.

Confirmed fact: the callback forwards Chromium net::Error integers with 0 meaning success and all non-zero values negative. Likely explanation: TLS handshake failures that are not certificate-specific also appear in the -200 range, e.g., -200 ERR_SSL_PROTOCOL_ERROR.

Preventing acceptance of invalid certificates when Chromium adds codes

Treat any non-zero code that is not explicitly whitelisted as a failure. Whitelist only the certificate errors you deliberately intend to ignore.

function verifyProc(request, callback) {
  const allowed = new Set([
    // add only specific codes you want to ignore
  ]);
  if (request.errorCode === 0) {
    callback(0);
    return;
  }
  if (allowed.has(request.errorCode)) {
    callback(0);
    return;
  }
  callback(-3);
}

This ensures newly introduced net::Error values are rejected rather than silently accepted.

Normalizing OS-specific DNS and TLS variations

The numeric code is consistent across OSes. Normalize by mapping ranges to logical categories:

• -199 to -100 → network/DNS issue
• -299 to -200 → certificate/TLS issue
• Other negative ranges → treat as failure

Verification steps

1. Log errorCode for valid cert, expired cert, self-signed cert, name mismatch, revoked cert, DNS failure, timeout, network disconnect.
2. Run on the Electron versions you support on Windows, macOS and Linux.
3. Compare logged numbers to Chromium's net_error_list.h for the corresponding Chromium base.
4. If any code falls outside documented ranges, treat as failure and report Electron/Chromium version.