search

nodejs / undici

An HTTP/1.1 client, written from scratch for Node.js
https://nodejs.github.io/undici
MIT License
6.14k stars 531 forks source link

fetch() ignores the "custom CA search paths" of node #2200

Open bewue opened 1 year ago

bewue commented 1 year ago

Bug Description

If you need to add a custom CA, you seem to have 3 possible solutions, but only the 3rd (not recommended) worked for me. For solution 1 and 2 i have placed my custom CA certificate at the according locations.

  1. --use-openssl-ca
  2. NODE_EXTRA_CA_CERTS
  3. NODE_TLS_REJECT_UNAUTHORIZED

Reproducible By

Place your custom CA certificate at the according locations. Try solution 1 or 2 and fetch() to an endpoint with an certificate which was signed by an unknown CA. The following "unprecise" error message will be thrown: TypeError: fetch failed

Expected Behavior

fetch() should use the same "custom CA search paths" like node itself

Environment

node v18.17.0 Ubuntu 22.04

mcollina commented 1 year ago

Thanks for reporting! Would you like to send a Pull Request to address this issue? Remember to add unit tests.

silverwind commented 1 year ago

The following "unprecise" error message will be thrown: TypeError: fetch failed

More info should be in error.cause, but keep note many error parsers do not process that property.

mcollina commented 1 year ago

That "unprecise" error is mandated by the spec.

sigorilla commented 4 months ago

Can you support NODE_EXTRA_CA_CERTS?

mcollina commented 4 months ago

PRs are welcomed. I don't see why they are not working as it is.

Uzlopak commented 1 month ago

I dont think that this has anything to do with undici. THe CA certs are loaded at node start up. We are basically not in control of those parameters.