Error "invalid peer certificate: UnknownIssuer" on Deno but not on Node

[DMeechan]

I get this error when connecting to a Supabase Postgres database using Postgres.js on Deno 1.36.3+c9223bc:

import postgres from "https://deno.land/x/postgresjs@v3.3.5/mod.js"; // For Deno
// import postgres from "postgres"; // For Node

const sql = postgres(databaseUrl, { ssl: "require" });
await sql`SELECT 1`;

// Result:
error: Uncaught (in promise) InvalidData: invalid peer certificate: UnknownIssuer
        while ((result = socket.readyState === 'open' && await raw.read(b))) {
                                                         ^
    at async TlsConn.read (ext:deno_net/01_net.js:107:15)

However, the code above works fine on Node.js v18.17.1

[DMeechan]

I was able to solve this error by setting DENO_CERT=./certs/supabase.crt env variable

However, is the error intentional? Or do we expect the code above to pass, like on Node?

[kahirokunn]

I encountered the same error message when I tried to use a client certificate.

https://github.com/nodejs/node/issues/48977

const { Agent } = require('undici');

fetch(url, {
    dispatcher: new Agent({
        connect: {
            cert: cert,
            key: key,
            ca: ca
        }
    })
});

[alexcouper]

Encountered the same issue. I'm using DENO_CERT to run tests as a result.

[karl19]

installing exit due to same issue

[LaurentChardin]

I have the same issue, and this is due to my company proxy, that is using zscaler which is replacing SSL certificates on the fly (you know.. firewalling, packet inspection, etc). Do we have an option to tell deno to trust the corporate certificate ?

Updated : ok i resolved it by downloading the install script, and adding DENO_CERT at the top to the chain PEM i extracted from the expected URL. Then i restarted the install script. And added DENO_CERT in my .zshrc file.

[ardabeyazoglu]

The issue is node and deno have different config options for specifying ca certificate. DENO_CERT also works but it is not always possible to change it, nor it is possible to specify multiple certificates on the fly with it (like customer specific certificates).

For nodejs tls.connect, ca: ["-----BEGIN CERTIFICATE-----\n..."] works. For deno tls, it must be caCerts: ["-----BEGIN CERTIFICATE-----\n..."]. Tested both with supabase and postgresjs now, both works.

It seems, ca and caCerts are not correctly mapped in node:tls. That would fix the issue.