Tracking issue: custom CA certificate support #58990

Trying to track the recent changes that allow easier configuration of custom CA certificate for constrained environments and the backports

• Support --use-system-ca for macOS feat: added support for reading certificates from macOS system store #56599
• Support --use-system-ca for Windows crypto: support --use-system-ca on Windows #56833
• Support --use-system-ca for other Unix-like platforms: crypto: support --use-system-ca on non-Windows and non-macOS #57009
• JS API to query CA certificates: tls: implement tls.getCACertificates() #57107
• JS API to configure the CA certificates crypto: add tls.setDefaultCACertificates() #58822
• Encouraging use of --use-system-ca in certificate errors: Suggest --use-system-ca when a certificate error occurs #57362
• Fixing leak of --use-system-ca crypto: fix X509* leak in --use-system-ca #56832
• Add NODE_USE_SYSTEM_CA=1 cli: add NODE_USE_SYSTEM_CA=1 #59276
• Load system CA certificates off thread crypto: load system CA certificates off thread #59550
• Only load certificates off thread when tls is used tls: only do off-thread certificate loading on loading tls #59856
• Make --use-system-ca a per-env option so that workers can enable/disable them individually Make --use-system-ca per-env rather than per-process #60678
• Graceful handling of invalid certificates: src: enable X509sToArrayOfStrings to skip errors #61784 crypto: improve system certificate enumeration logic on macOS #62576
• Implement certificate distrust on Windows to match Chromium's policy:

  node/src/crypto/crypto_context.cc

  Lines 647 to 648 in 5623194

  	// TODO(joyeecheung): match Chromium's policy, collect more certificates
  	// from user-added CAs and support disallowed (revoked) certificates.

• Make NODE_USE_SYSTEM_CA=0 disable system CA if it gets enabled by default
• Provide a build-time option to enable --use-system-ca by default
• Enable --use-system-ca by default