quic: expose QUIC certificates as JS X509Certificate, not raw handles

[pimterry]

Starting to work through the TLS implementation in QUIC, one nice small standalone fix here.

[nodejs-github-bot]

Review requested:

• @nodejs/quic

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.08%. Comparing base (b5da751) to head (a191984).
⚠️ Report is 155 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #63191      +/-   ##
==========================================
+ Coverage   90.03%   90.08%   +0.04%     
==========================================
  Files         713      714       +1     
  Lines      224510   225759    +1249     
  Branches    42438    42734     +296     
==========================================
+ Hits       202148   203367    +1219     
- Misses      14163    14193      +30     
  Partials     8199     8199              

Files with missing lines	Coverage Δ
lib/internal/quic/quic.js	100.00% <100.00%> (ø)

... and 100 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73432/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73452/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73598/

[sxa]

CI: https://ci.nodejs.org/job/node-test-pull-request/73598/

FYI ignore the pummel failures on aix73-power9 - that's unrelated to this PR. I just switched on that axis this morning and have disabled again while it's investigated.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73602/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/73605/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/63191
✔  Done loading data for nodejs/node/pull/63191
----------------------------------- PR info ------------------------------------
Title      quic: expose QUIC certificates as JS X509Certificate, not raw handles (#63191)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     pimterry:fix-quic-peer-certificate -> nodejs:main
Labels     needs-ci, quic, commit-queue-squash
Commits    2
 - quic: expose QUIC certificates as JS X509Certificate, not raw handles
 - Fix no-crypto builds
Committers 1
 - Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63191
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/63191
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 08 May 2026 11:13:00 GMT
   ✔  Approvals: 3
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/63191#pullrequestreview-4252294171
   ✔  - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/63191#pullrequestreview-4299399955
   ✔  - Stephen Belanger (@Qard): https://github.com/nodejs/node/pull/63191#pullrequestreview-4334550569
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-05-21T15:55:03Z: https://ci.nodejs.org/job/node-test-pull-request/73605/
- Querying data for job/node-test-pull-request/73605/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 63191
From https://github.com/nodejs/node
 * branch                  refs/pull/63191/merge -> FETCH_HEAD
✔  Fetched commits as f835cc42da4e..a19198458c31
--------------------------------------------------------------------------------
Auto-merging doc/api/quic.md
Auto-merging lib/internal/quic/quic.js
CONFLICT (content): Merge conflict in lib/internal/quic/quic.js
error: could not apply 4478d4ba7e... quic: expose QUIC certificates as JS X509Certificate, not raw handles
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
   ✘  Failed to apply patches

https://github.com/nodejs/node/actions/runs/26253721782

[pimterry]

Just spotted this, I think the commit-queue raced with another QUIC PR and ended up conflicted.

Now rebased and resolved, no other changes. I'd love a re-review please if anybody has a sec, and then this can get moving again.

[bjohansebas]

LGTM!

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74266/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74297/

[nodejs-github-bot]

Landed in 6d5a085