search

elixir-mint / mint

Functional HTTP client for Elixir with support for HTTP/1 and HTTP/2 🌱
Apache License 2.0
1.36k stars 106 forks source link

HOWTO workaround: CLIENT ALERT: Fatal - Unknown CA #337

Closed CharlesOkwuagwu closed 2 years ago

CharlesOkwuagwu commented 2 years ago

Please how do we work around this error:

%Mint.TransportError{reason: {:tls_alert, {:unknown_ca, 'TLS client: In state certify at ssl_handshake.erl:2015 generated CLIENT ALERT: Fatal - Unknown CA\n'}}}

Target Domain : https://secure.flydanaair.com

ericmj commented 2 years ago

The server is providing an incomplete certificate chain and Mint is not able to fill the missing parts. For Mint to support incomplete chains like these we would have to download the intermediate certificates on demand from the certificate provider and try to stitch the chain together ourselves.

This is out-of-scope for Mint at this time and doesn't really fit the low-level model of explicit connection handling in Mint. The server should fix this on their end but one workaround you could do would be to manually download the missing intermediate certificate and build your own certificate store with it included and pass it to Mint through the option [transport_opts: cacertfile: ...]].