Node.js server-side fetches fail with "self-signed certificate in certificate chain"

[neefrehman]

Problem

Server-side fetch() calls in Next.js (e.g. from Server Components or SSR) to portless-proxied HTTPS services fail with:

Error: self-signed certificate in certificate chain

This is related to but distinct from #202. That issue reports the CA certificate is missing from the chain (UNABLE_TO_VERIFY_LEAF_SIGNATURE). This issue is about Node.js not trusting the portless Local CA even when it's present in the chain.

Browser requests work fine because portless adds the CA to the system trust store, which browsers respect. However, Node.js does not use the system trust store by default — it ships its own hardcoded CA bundle.

Setup

We run the portless proxy with HTTPS on port 443:

portless proxy start -p 443 --https

Next.js server components then make fetch() calls to https://backend.<worktree>.localhost/graphql, which go through the portless proxy.

Expected behavior

Node.js server-side fetches to portless-proxied HTTPS services should work without additional configuration. Possible solutions:

• Portless could automatically set NODE_EXTRA_CA_CERTS pointing to the portless CA cert for child processes
• Or document NODE_EXTRA_CA_CERTS as a required step for frameworks with server-side rendering

Workaround

Set NODE_TLS_REJECT_UNAUTHORIZED=0 in the environment of the Node.js process (disables all TLS verification — not ideal).

Environment

• portless 0.9.4
• macOS 15.5 (Darwin 25.4.0)
• Node.js (Next.js 16.2.1 Turbopack, React Server Components)