Repository navigation
NODE_EXTRA_CA_CERTS not recognized #55285
Description
Version
20.18.0
Platform
Linux pi01 6.1.21-v8+
Subsystem
No response
What steps will reproduce the bug?
I'm running this test script with command line:
$ NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/SSL_CA.crt node 'test.js'
const https = require('https')
const fs = require('fs');
console.log(process.env);
const options = {
hostname: 'api.server.local',
port: 443,
path: '/',
method: 'GET',
// Necessary self-signed certificate.
//ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ]
}
https.get(options, (res) => {
console.log('statusCode:', res.statusCode);
console.log('headers:', res.headers);
}).on('error', (e) => {
console.error(e);
});
I'm getting
{
NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/SSL_CA.crt',
SHELL: '/bin/bash',
NO_AT_BRIDGE: '1',
PWD: '/home/iobroker',
LOGNAME: 'iobroker',
HOME: '/home/iobroker',
LANG: 'en_GB.UTF-8',
LS_COLORS: 'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:',
TERM: 'xterm',
USER: 'iobroker',
SHLVL: '1',
PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games',
MAIL: '/var/mail/iobroker',
TEXTDOMAIN: 'Linux-PAM',
_: '/usr/bin/node'
}
Error: unable to verify the first certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34)
at TLSSocket.emit (node:events:519:28)
at TLSSocket._finishInit (node:_tls_wrap:1076:8)
at ssl.onhandshakedone (node:_tls_wrap:862:12) {
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}
Once I remove comment from that line ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ] I get the expected result.
How often does it reproduce? Is there a required condition?
no
What is the expected behavior? Why is that the expected behavior?
Output:
statusCode: 302
headers: {
server: 'nginx',
date: 'Sat, 05 Oct 2024 18:55:05 GMT',
'content-type': 'application/json; charset=utf-8',
'transfer-encoding': 'chunked',
connection: 'keep-alive',
'keep-alive': 'timeout=60',
'x-version': 'v7.28.0',
'x-build': '2198 (Wed, 25 Sep 2024 14:27:14 +0200)',
'x-pid': 'bArSLh1X',
'x-process-time': '5 ms',
'access-control-allow-origin': '*',
'access-control-allow-methods': 'OPTIONS,HEAD,GET,POST',
'access-control-allow-headers': 'Origin,Content-Type,Authorization,X-Requested-With,X-Delimiter,X-Separator,X-No-Cache',
location: '/help'
}
What do you see instead?
Error: unable to verify the first certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34)
at TLSSocket.emit (node:events:519:28)
at TLSSocket._finishInit (node:_tls_wrap:1076:8)
at ssl.onhandshakedone (node:_tls_wrap:862:12) {
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}
Additional information
see also maybe relate: #52549, #51426, #51497
https://nodejs.org/api/cli.html#node_extra_ca_certsfile
it's not running it as root nor file capabilities got set,.
Edit:
I forgot to mention also "NODE_OPTIONS=--use-openssl-ca" does not work anymore either. As you can see the certificate is in system certificate store (added via update-ca-certificates) and works perfectly for any other application. Using NODE_EXTRA_CA_CERTS was just part of troubleshooting for not working use-openssl-ca option.
Activity
avivkeller commentedon Oct 6, 2024
Can you verify that /usr/local/share/ca-certificates/SSL_CA.crt is valid?
If possible, is this reproducible with a certificate that was just generated-and how it was generated
avivkeller commentedon Oct 6, 2024
Can you verify that /usr/local/share/ca-certificates/SSL_CA.crt is valid?
If possible, is this reproducible with a certificate that was just generated-and how it was generated
Subnum12 commentedon Oct 6, 2024
For exact that reason I did add the line
ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ]to my test script. Once you remove leading comment it does load the certificate in the same way NODE_EXTRA_CA_CERTS should do.As this results in expected behavior (URL can be accessed) it proofs the certificate is valid for that URL and
NODE_EXTRA_CA_CERTSandNODE_OPTIONS=--use-openssl-cado not have expected behavior.avivkeller commentedon Oct 6, 2024
Thanks for the additional info.
Subnum12 commentedon Oct 31, 2024
today I checked with v23.1.0. Here the issue go already fixed.