Outgoing Webhook fails with SELF_SIGNED_CERT_IN_CHAIN because of corporate CA cert

Description:

Requests for a new outgoing Webhook we created fails with SELF_SIGNED_CERT_IN_CHAIN in the log.

Our rocket chat installation is behind a corporate firewall, where the company uses its own CA certificate.

I should be possible with node to use the NODE_EXTRA_CA_CERTS environment variable to point to an extra file containing certificates, to be able to include the corporate CA certificate.

However, because we are using a snap app Rocket.Chat server, there seems to be no opportunity to insert the environment variable anywhere, except perhaps by modifying the environment of the current snap version, but this would be modified when the snap is next updated. We have tried both NODE_EXTRA_CA_CERTS and CAFILE (suggestion from Meteor) environment variables, by using service config override. We can confirm they are set in the running processes for the Rocket.Chat service, but they have no effect.

The following forum discussion monologue refers: https://forums.rocket.chat/t/self-signed-cert-in-chain-from-npm-in-snap-installation/1585

Steps to reproduce:

This problem is difficult to reproduce, unless you are behind a corporate firewall where the company inserts its own CA root certificate into all requests.

In that case, an outgoing webhook that makes a request to an HTTPS resource fails.

Expected behavior:

It should be possible to add an additional CA certificate so that the Rocket.Chat node installation trusts this as well.

Actual behavior:

We have already tried two possibilities for adding the NODE_EXTRA_CA_CERTS, but both involve modifying the root user's environment which is presumably disregarded in the snap's execution environment.
As described above, we have tried both the NODE_EXTRA_CA_CERTS and CAFILE environment variables, but these seem to have no effect in taking into account our own extra root CA certificate. As a result, we are still getting SELF_SIGNED_CERT_IN_CHAIN errors when Rocket tries to make an outgoing call for a webhook.

Server Setup Information:

• Version of Rocket.Chat Server: 0.66.3
• Operating System: Ubuntu (Linux_x64)
• Deployment Method: snap
• Number of Running Instances: 1
• NodeJS Version: 8.11.3
• MongoDB Version: 3.2.7

Relevant logs:

I20180723-07:21:46.012(2) rocketchat_logger rocketchat_logger.js:278 Integrations ➔ Outgoing WebHook.error Error for the Integration "JIRA" to [CENSORED] is: 
I20180723-07:21:46.013(2) rocketchat_logger rocketchat_logger.js:278 Integrations ➔ Outgoing WebHook.error { Error: self signed certificate in certificate chain     at TLSSocket.<anonymous> (_tls_wrap.js:1105:38)     at emitNone (events.js:106:13)     at TLSSocket.emit (events.js:208:7)     at TLSSocket._finishInit (_tls_wrap.js:639:8)     at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:469:38)  code: 'SELF_SIGNED_CERT_IN_CHAIN' } 

Start by tracing the outgoing WebHook request path and the rocketchat_logger.js:278 error entry, then inspect how the Rocket.Chat service handles NODE_EXTRA_CA_CERTS and CAFILE. Done means an outgoing HTTPS webhook trusts an additional corporate CA and no longer fails with SELF_SIGNED_CERT_IN_CHAIN, including for the snap deployment.