Closed djKianoosh closed 7 years ago
https://github.com/nodejs/node/pull/8334 looks like is a compile time option :-1:
hi, thanks for the report! I'm very close to a release candidate which will have cli options to set TLS options like ca
, ciphers
etc. Watch this space.. Let me know if you find anything else, now would be a good time..
That's awesome. I'll definitely try it as soon as it's available.
There is one awful workaround I hesitate to mention but it is setting the env var:
# DO NOT USE THIS....
NODE_TLS_REJECT_UNAUTHORIZED="0"
I wish Node itself would let us set an env variable to specify CA, but that is another story...
Cheers!
Hi, I'm planning to look at this tonight.
The issue comes from the rewrite middleware which is proxying '/ta/* -> https://__internal.hostname__/path/$1'
for you.
The proxy request is complaining as the certificate supplied by your internal API server was issued by a CA it can't verify. There are two solutions i can think of:
rejectUnauthorized: false
see here)key
, cert
, pfx
, ciphers
, ca
and other config to try help them achieve a 100% verified TLS link. Option 1 is the clear favourite, unless you have any reasons otherwise. Let me know.
hmmm... something about ignoring TLS/cert issues just doesn't sit well, but I guess the point of this tool is to run an app locally, and you should know what you're proxying to for your backend APIs, so in a way, you really should know better. Or at least, you ought to know what you're proxying to...
Given that assumption and option 1 is probably a heck of a lot easier to implement, yeah I can see where that would be a better choice.
The only argument really is of course, as you say, 100% verified TLS link. How important is that when developing a JS lib locally against a set of backend APIs? Only users of this library can say for sure.
I'll be good with whatever you decide :) :+1:
i released v2.0.0-pre.4 which ignores CA verification issues by default.. as ws
is only a development server (not production) I have a feeling this will be the preferred default for most users, who want proxied rewrites to "just work" and not spend hours wrestling with TLS/OpenSSL..
$ npm install local-web-server@next
However, i'm not finished there. I will make proxy requests fully configurable in the future so users that want strict TLS can have it, passing in CA certificate chains etc.
Just tested it and it works great. Kudos! :100:
btw, love the more verbose output when using -v
:+1:
Using versions:
Say I have a backend server whose ssl cert was signed by my internal org's root ca. I have a rewrite rule here like so:
We get the following errors:
I think the problem is that node apparently hard codes its certificate authorities:
And there's a global option to supply your own ca certs file:
https.globalAgent.options.ca
Do you think we could have something like:
which would set that global option?