unknown directive "js_fetch_trusted_certificate" but js_import, js_content work

remember-to-change-this commented 1 month ago

Describe the bug

I've build njs module from source ensuring nginx 1.25.5 and njs 0.8.5 but I cant figure out why some directives are working and others are not found, specifically the "js_fetch_trusted_certificate" as I need to use ngx.fetch to a https endpoint. Any ideas on what I'm missing?

To reproduce

JS script

let response = await ngx.fetch(`https://myserverendpoint/`, {
method: 'POST',
headers: {
  'Content-Type': 'application/x-www-form-urlencoded',
},
body: body,
});
body = await response.json();

NGINX configuration if applicable

location / {
    internal;
    js_content http.hello;
    js_fetch_trusted_certificate /etc/nginx/certificate.pem; 
}

Output of the nginx -V command if applicable. /etc/nginx $ nginx -V nginx version: nginx/1.25.5 built by gcc 13.2.1 20240309 (Alpine 13.2.1_git20240309) built with OpenSSL 3.3.1 4 Jun 2024 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --modules-path=/etc/nginx/modules --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-compat --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_gzip_static_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-stream --with-stream_ssl_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-http_secure_link_module --with-http_gunzip_module --with-file-aio --without-mail_pop3_module --without-mail_smtp_module --without-mail_imap_module --without-http_uwsgi_module --without-http_scgi_module --with-cc-opt='-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wno-deprecated-declarations -fno-strict-aliasing -D_FORTIFY_SOURCE=2 --param=ssp-buffer-size=4 -DTCP_FASTOPEN=23 -fPIC -Wno-cast-function-type -m64 -mtune=generic' --with-ld-opt='-fPIE -fPIC -pie -Wl,-z,relro -Wl,-z,now' --user=www-data --group=www-data --add-module=/tmp/build/ngx_devel_kit --add-module=/tmp/build/set-misc-nginx-module --add-module=/tmp/build/headers-more-nginx-module --add-module=/tmp/build/ngx_http_substitutions_filter_module --add-module=/tmp/build/lua-nginx-module --add-module=/tmp/build/stream-lua-nginx-module --add-module=/tmp/build/lua-upstream-nginx-module --add-dynamic-module=/tmp/build/nginx-http-auth-digest --add-dynamic-module=/tmp/build/ModSecurity-nginx --add-dynamic-module=/tmp/build/ngx_http_geoip2_module --add-dynamic-module=/tmp/build/ngx_brotli
Exact steps to reproduce the behavior

Expected behavior

Expected no error and ngx.fetch to work with my https:// endpoint. Without this directive the error "client sent plain HTTP request to HTTPS port while reading client request headers" shows.

Your environment

Version of njs or specific commit 0.8.5
Version of NGINX if applicable 1.25.5 (ingress-nginx)
List of other enabled nginx modules if applicable none
OS: [e.g. Ubuntu 20.04] Alpine 13.2.1_git20240309

xeioex commented 1 month ago

Hi @remember-to-change-this,

It seems that you built modules without openssl available. See this ifdef. At the same time I see --with-http_ssl_module in your nginx -V, this is a bit strange. Anyway NGX_HTTP_SSL was not defined at the moment of the module compilation.

remember-to-change-this commented 1 month ago

Thanks so much @xeioex that was exactly the problem. I had a multi-stage build in my dockerfile so the output above didnt reflect the image during build stage. Needed to add --with-http_ssl_module, thanks again.

nginx / njs