fetch() ignores the "custom CA search paths" of node
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 7.7k
- Forks
- 880
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 68
Description
Bug Description
If you need to add a custom CA, you seem to have 3 possible solutions, but only the 3rd (not recommended) worked for me.
For solution 1 and 2 i have placed my custom CA certificate at the according locations.
- --use-openssl-ca
- NODE_EXTRA_CA_CERTS
- NODE_TLS_REJECT_UNAUTHORIZED
Reproducible By
Place your custom CA certificate at the according locations.
Try solution 1 or 2 and fetch() to an endpoint with an certificate which was signed by an unknown CA.
The following "unprecise" error message will be thrown: TypeError: fetch failed
Expected Behavior
fetch() should use the same "custom CA search paths" like node itself
Environment
node v18.17.0
Ubuntu 22.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the fetch() behavior on Node v18.17.0 and Ubuntu 22.04 with --use-openssl-ca and NODE_EXTRA_CA_CERTS, using an endpoint signed by the custom CA. Compare this with Node's direct behavior; done means fetch() trusts the custom CA search paths and provides a useful failure when validation still fails.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100