Skip to content

NODE_EXTRA_CA_CERTS not recognized #55285

Closed

Description

@Subnum12

Version

20.18.0

Platform

Linux pi01 6.1.21-v8+

Subsystem

No response

What steps will reproduce the bug?

I'm running this test script with command line:
$ NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/SSL_CA.crt node 'test.js'

const https = require('https')
const fs = require('fs');
console.log(process.env);
const options = {
  hostname: 'api.server.local',
  port: 443,
  path: '/',
  method: 'GET',
  // Necessary self-signed certificate.
  //ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ]
}

  https.get(options, (res) => {
  console.log('statusCode:', res.statusCode);
  console.log('headers:', res.headers);
}).on('error', (e) => {
  console.error(e);
});

I'm getting

{
  NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/SSL_CA.crt',
  SHELL: '/bin/bash',
  NO_AT_BRIDGE: '1',
  PWD: '/home/iobroker',
  LOGNAME: 'iobroker',
  HOME: '/home/iobroker',
  LANG: 'en_GB.UTF-8',
  LS_COLORS: 'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:',
  TERM: 'xterm',
  USER: 'iobroker',
  SHLVL: '1',
  PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games',
  MAIL: '/var/mail/iobroker',
  TEXTDOMAIN: 'Linux-PAM',
  _: '/usr/bin/node'
}
Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1076:8)
    at ssl.onhandshakedone (node:_tls_wrap:862:12) {
  code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}

Once I remove comment from that line ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ] I get the expected result.

How often does it reproduce? Is there a required condition?

no

What is the expected behavior? Why is that the expected behavior?

Output:

statusCode: 302
headers: {
  server: 'nginx',
  date: 'Sat, 05 Oct 2024 18:55:05 GMT',
  'content-type': 'application/json; charset=utf-8',
  'transfer-encoding': 'chunked',
  connection: 'keep-alive',
  'keep-alive': 'timeout=60',
  'x-version': 'v7.28.0',
  'x-build': '2198 (Wed, 25 Sep 2024 14:27:14 +0200)',
  'x-pid': 'bArSLh1X',
  'x-process-time': '5 ms',
  'access-control-allow-origin': '*',
  'access-control-allow-methods': 'OPTIONS,HEAD,GET,POST',
  'access-control-allow-headers': 'Origin,Content-Type,Authorization,X-Requested-With,X-Delimiter,X-Separator,X-No-Cache',
  location: '/help'
}

What do you see instead?

Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1076:8)
    at ssl.onhandshakedone (node:_tls_wrap:862:12) {
  code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}

Additional information

see also maybe relate: #52549, #51426, #51497

https://nodejs.org/api/cli.html#node_extra_ca_certsfile

it's not running it as root nor file capabilities got set,.

Edit:

I forgot to mention also "NODE_OPTIONS=--use-openssl-ca" does not work anymore either. As you can see the certificate is in system certificate store (added via update-ca-certificates) and works perfectly for any other application. Using NODE_EXTRA_CA_CERTS was just part of troubleshooting for not working use-openssl-ca option.

Activity

  1. avivkeller commented on Oct 6, 2024

    @avivkeller
    Member

    Can you verify that /usr/local/share/ca-certificates/SSL_CA.crt is valid?

    If possible, is this reproducible with a certificate that was just generated-and how it was generated

  2. avivkeller commented on Oct 6, 2024

    @avivkeller
    Member

    Can you verify that /usr/local/share/ca-certificates/SSL_CA.crt is valid?

    If possible, is this reproducible with a certificate that was just generated-and how it was generated

  3. Subnum12 commented on Oct 6, 2024

    @Subnum12
    Author

    For exact that reason I did add the line ca: [ fs.readFileSync('/usr/local/share/ca-certificates/SSL_CA.crt') ] to my test script. Once you remove leading comment it does load the certificate in the same way NODE_EXTRA_CA_CERTS should do.

    As this results in expected behavior (URL can be accessed) it proofs the certificate is valid for that URL and NODE_EXTRA_CA_CERTS and NODE_OPTIONS=--use-openssl-ca do not have expected behavior.

  4. avivkeller commented on Oct 6, 2024

    @avivkeller
    Member

    Thanks for the additional info.

  5. added
    opensslIssues and PRs related to the OpenSSL dependency.
    cliIssues and PRs related to the Node.js command-line interface.
    on Oct 6, 2024
  6. Subnum12 commented on Oct 31, 2024

    @Subnum12
    Author

    today I checked with v23.1.0. Here the issue go already fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cliIssues and PRs related to the Node.js command-line interface.opensslIssues and PRs related to the OpenSSL dependency.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions