-
-
Couldn't load subscription status.
- Fork 33.6k
Closed
Labels
tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.wontfixIssues that will not be fixed.Issues that will not be fixed.
Description
Version
24.7.0
Platform
Linux c12d480d584b 6.10.10-200.fc40.aarch64 #1 SMP PREEMPT_DYNAMIC Thu Sep 12 18:52:07 UTC 2024 aarch64 GNU/Linux
Subsystem
No response
What steps will reproduce the bug?
- Download the nodeJS Docker image tagged 24.7.0
- Create a container and run the following command:
node -e "fetch('https://www.relialabtest.com/').then(res => { console.log('Status:', res.status); return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
- Observe the error
UNABLE_TO_GET_ISSUER_CERT_LOCALLY - Run the following command:
NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt node -e "fetch('https://www.relialabtest.com/').then(res => { console.log('Status:', res.status); return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
- Observe it now works
How often does it reproduce? Is there a required condition?
This happens every time.
What is the expected behavior? Why is that the expected behavior?
I expect the request to complete successfully instead of give a TLS error. Since this is just a GET call to a website, I expect to see the HTML of the website.
What do you see instead?
TypeError: fetch failed
at node:internal/deps/undici/undici:15445:13
at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
[cause]: Error: unable to get local issuer certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1631:34)
at TLSSocket.emit (node:events:508:28)
at TLSSocket._finishInit (node:_tls_wrap:1077:8)
at ssl.onhandshakedone (node:_tls_wrap:863:12) {
code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
}
}
Additional information
This may only happen with sites that have the a cert signed by the following CA:
Cloudflare TLS Issuing ECC CA 1
This also appears to be happening node Node v22, I believe on version v22.20.0 and later. It seems like node is not getting the system certificates or something since it works just fine if the var NODE_EXTRA_CA_CERTS is set to use the system CA certs found at /etc/ssl/certs/ca-certificates.crt
Metadata
Metadata
Assignees
Labels
tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.wontfixIssues that will not be fixed.Issues that will not be fixed.