Make self-signed certificates work for development

[cewald]

If the connected Magento (1.9 in our case) shop uses a self-signed certificate, e.g. in development environment, the API will drop the error message Error occured: Error: self signed certificate and won’t be able to connect to your Magento instance using e.g. DivanteLtd/magento1-vsbridge and DivanteLtd/magento1-vsbridge-client.

To prevent this behavior and make a dev environment work, you can disable TLS rejection using an env variable called NODE_TLS_REJECT_UNAUTHORIZED.

In our case we added it to our docker-compose file like:

…
services:
  vsf-api-app:
    image: divante/vue-storefront-api
    …
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
    …

!!! Of course, this shouldn't be used in a production environment.

[lukeromanowicz]

Although adding that env variable will make it work, it's unsafe to use it. We cannot accept that because many users base their prod environment on the provided docker-compose files.

A preferable way to solve it would be creating a shared directory for storing self-signed certs and using syswide-cas to load them into the application runtime.

[cewald]

Yes, indeed. It's definitly a work around for the develop environment or e.g. test runs during continuos integration only and clearly not meant to be used in production. The idea with a shared folder surely would work but is quiet a lot of configuration for developing or testing. I'm not sure whats the better way or at least how to mark it as dev-only setting.
I just stumbled about this issue during testing and found this quiet painless solution that I thought would be good to know for everybody elses first steps with this system.

[lukeromanowicz]

I would argue that it's lots of configuration. Maybe it's a little bit more development to set it up but later the only configuration you need to do is to dump your self signed certificates to the 'certs' directory or whatever it will be called.

Regarding your solution: it's a workaround for a local dev environment which of course might be helpful for other devs facing this problem but as I mentioned above, we cannot merge it because of security reasons.

[lukeromanowicz]

@cewald I've prepared a PR featuring syswide-cas approach. Feel free to test it and share your opinion 🙂