Fixes #${283}

README.md

@@ -432,6 +432,7 @@ const zbc = new ZBClient("my-secure-broker.io:443", {
 		audience: "my-secure-broker.io",
 		clientId: "myClientId",
 		clientSecret: "randomClientSecret",
+		customRootCert: fs.readFileSync('./my_CA.pem'),
 		cacheOnDisk: true
 	}
 }
@@ -441,6 +442,8 @@ The `cacheOnDisk` option will cache the token on disk in `$HOME/.camunda`, which
 
 If the cache directory is not writable, the ZBClient constructor will throw an exception. This is considered fatal, as it can lead to denial of service or hefty bills if you think caching is on when it is not.
 
+The `customRootCert` argument is optional. It can be used to provide a custom TLS certificate as a Buffer, which will be used while obtaining the OAuth token from the specified URL. If not provided, the CAs provided by [Mozilla](https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport) will be used.
+
 <a name = "basic-auth"></a>
 
 ## Basic Auth

package.json

@@ -80,7 +80,7 @@
 		"@types/debug": "0.0.31",
 		"@types/got": "^9.6.9",
 		"@types/jest": "^27.5.2",
-		"@types/node": "^10.17.17",
+		"@types/node": "^10.17.60",
 		"@types/promise-retry": "^1.1.3",
 		"@types/stack-trace": "0.0.29",
 		"@types/uuid": "^3.4.4",

src/lib/OAuthProvider.ts

@@ -21,6 +21,8 @@ export interface OAuthProviderConfig {
 	audience: string
 	clientId: string
 	clientSecret: string
+	/** Custom TLS certificate for OAuth */
+	customRootCert?: Buffer
 	/** Cache token in memory and on filesystem? */
 	cacheOnDisk?: boolean
 	/** Override default token cache directory */
@@ -36,6 +38,7 @@ export class OAuthProvider {
 	public url: string
 	public clientId: string
 	public clientSecret: string
+	public customRootCert?: Buffer
 	public useFileCache: boolean
 	public tokenCache = {}
 	private failed = false
@@ -49,6 +52,8 @@ export class OAuthProvider {
 		cacheDir,
 		clientId,
 		clientSecret,
+		/** Custom TLS certificate for OAuth */
+		customRootCert,
 		/** Cache token in memory and on filesystem? */
 		cacheOnDisk,
 	}: {
@@ -57,12 +62,14 @@ export class OAuthProvider {
 		cacheDir?: string
 		clientId: string
 		clientSecret: string
+		customRootCert?: Buffer
 		cacheOnDisk: boolean
 	}) {
 		this.url = url
 		this.audience = audience
 		this.clientId = clientId
 		this.clientSecret = clientSecret
+		this.customRootCert = customRootCert
 		this.useFileCache = cacheOnDisk
 		this.cacheDir = cacheDir || OAuthProvider.getTokenCacheDirFromEnv()
 
@@ -130,6 +137,9 @@ export class OAuthProvider {
 					'content-type': 'application/x-www-form-urlencoded',
 					'user-agent': this.userAgentString,
 				},
+				https: {
+					certificateAuthority: this.customRootCert
+				}
 			})
 			.then(res => {
 				return this.safeJSONParse(res.body).then(token => {

src/zb/ZBClient.ts

@@ -147,6 +147,7 @@ export class ZBClient extends TypedEmitter<typeof ConnectionStatusEvent> {
 		this.oAuth = this.options.oAuth
 			? new OAuthProvider(
 					this.options.oAuth as OAuthProviderConfig & {
+						customRootCert: Buffer
 						cacheDir: string
 						cacheOnDisk: boolean
 					}