From ca903891360eebd29c9264c606a3a2c47af85796 Mon Sep 17 00:00:00 2001
From: Tamir Duberstein <tamird@gmail.com>
Date: Sun, 18 Oct 2026 08:50:03 -0400
Subject: [PATCH] test: send SNI in CA certificate test

Set servername when connecting to www.nodejs.org so the server selects
its certificate for that hostname. Without SNI, it returns a certificate
that does not cover www.nodejs.org, and the test fails before exercising
CA handling. The nightly internet test is failing with this error [1].

Reproduce the certificate mismatch without Node.js:

    openssl s_client -connect www.nodejs.org:443 -noservername \
      -verify_hostname www.nodejs.org -verify_return_error </dev/null

This reports "verify error:num=62:Hostname mismatch". Replacing
-noservername with -servername www.nodejs.org succeeds.

[1]: https://github.com/nodejs/node/actions/runs/39084453901

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Assisted-by: Codex
---
 test/internet/test-tls-add-ca-cert.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/internet/test-tls-add-ca-cert.js b/test/internet/test-tls-add-ca-cert.js
index 2515758ec86c..3f76f2b95e7b 100644
--- a/test/internet/test-tls-add-ca-cert.js
+++ b/test/internet/test-tls-add-ca-cert.js
@@ -23,6 +23,7 @@ const caCert = loadPEM('ca1-cert');
 
 const opts = {
   host: 'www.nodejs.org',
+  servername: 'www.nodejs.org',
   port: 443,
   rejectUnauthorized: true,
 };