Skip to content

UNABLE_TO_GET_ISSUER_CERT_LOCALLY #60284

@jakewaggoner

Description

@jakewaggoner

Version

24.7.0

Platform

Linux c12d480d584b 6.10.10-200.fc40.aarch64 #1 SMP PREEMPT_DYNAMIC Thu Sep 12 18:52:07 UTC 2024 aarch64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

  1. Download the nodeJS Docker image tagged 24.7.0
  2. Create a container and run the following command:
node -e "fetch('https://www.relialabtest.com/').then(res => {  console.log('Status:', res.status);  return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
  1. Observe the error UNABLE_TO_GET_ISSUER_CERT_LOCALLY
  2. Run the following command:
NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt node -e "fetch('https://www.relialabtest.com/').then(res => {  console.log('Status:', res.status);  return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
  1. Observe it now works

How often does it reproduce? Is there a required condition?

This happens every time.

What is the expected behavior? Why is that the expected behavior?

I expect the request to complete successfully instead of give a TLS error. Since this is just a GET call to a website, I expect to see the HTML of the website.

What do you see instead?

TypeError: fetch failed
    at node:internal/deps/undici/undici:15445:13
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:_tls_wrap:1631:34)
      at TLSSocket.emit (node:events:508:28)
      at TLSSocket._finishInit (node:_tls_wrap:1077:8)
      at ssl.onhandshakedone (node:_tls_wrap:863:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

Additional information

This may only happen with sites that have the a cert signed by the following CA:
Cloudflare TLS Issuing ECC CA 1

This also appears to be happening node Node v22, I believe on version v22.20.0 and later. It seems like node is not getting the system certificates or something since it works just fine if the var NODE_EXTRA_CA_CERTS is set to use the system CA certs found at /etc/ssl/certs/ca-certificates.crt

Metadata

Metadata

Assignees

No one assigned

    Labels

    tlsIssues and PRs related to the tls subsystem.wontfixIssues that will not be fixed.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions