doc: document that NODE_EXTRA_CA_CERTS is read only once

Fixes: #20432

PR-URL: #37562
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Author: jasnell

doc/api/cli.md

@@ -1312,6 +1312,10 @@ options property is explicitly specified for a TLS or HTTPS client or server.
 This environment variable is ignored when `node` runs as setuid root or
 has Linux file capabilities set.
 
+The `NODE_EXTRA_CA_CERTS` environment variable is only read when the Node.js
+process is first launched. Changing the value at runtime using
+`process.env.NODE_EXTRA_CA_CERTS` has no effect on the current process.
+
 ### `NODE_ICU_DATA=file`
 <!-- YAML
 added: v0.11.15

doc/node.1

@@ -576,6 +576,13 @@ but any errors are otherwise ignored.
 .Pp
 This environment variable is ignored when `node` runs as setuid root or
 has Linux file capabilities set.
+.Pp
+The
+.Ar NODE_EXTRA_CA_CERTS
+environment variable is only read when the Node.js process is first launched.
+Changing the value at runtime using
+.Ar process.env.NODE_EXTRA_CA_CERTS
+has no effect on the current process.
 .
 .It Ev NODE_ICU_DATA Ar file
 Data path for ICU (Intl object) data.

lib/internal/main/print_help.js

@@ -39,7 +39,7 @@ const envVars = new SafeMap(ArrayPrototypeConcat([
   ['NODE_DISABLE_COLORS', { helpText: 'set to 1 to disable colors in ' +
     'the REPL' }],
   ['NODE_EXTRA_CA_CERTS', { helpText: 'path to additional CA certificates ' +
-    'file' }],
+    'file. Only read once during process startup.' }],
   ['NODE_NO_WARNINGS', { helpText: 'set to 1 to silence process warnings' }],
   ['NODE_PATH', { helpText: `'${require('path').delimiter}'-separated list ` +
     'of directories prefixed to the module search path' }],