nodejs - error self signed certificate in certificate chain

Question

I am facing a problem with client side https requests.

A snippet can look like this:

var fs = require('fs');
var https = require('https');

var options = {
    hostname: 'someHostName.com',
    port: 443,
    path: '/path',
    method: 'GET',
    key: fs.readFileSync('key.key'),
    cert: fs.readFileSync('certificate.crt')
}

var requestGet = https.request(options, function(res){
    console.log('resObj', res);
}

What I get is Error: self signed certificate in certificate chain.

When I use Postman I can import the client certificate and key and use it without any problem. Is there any solution available?? I would also like to be given some lights on how postman handles the certificates and works.

score 214 · Accepted Answer · edited Jul 11 '21 at 20:46

214

Option 1: Disable the warning (useful for dev)

From your question I'm guessing you are doing this in development as you are using a self signed certificate for SSL communication.

If that's the case, add as an environment variable wherever you are running node

export NODE_TLS_REJECT_UNAUTHORIZED='0'
node app.js

or running node directly with

NODE_TLS_REJECT_UNAUTHORIZED='0' node app.js

This instructs Node to allow untrusted certificates (untrusted = not verified by a certificate authority)

If you don't want to set an environment variable or need to do this for multiple applications npm has a strict-ssl config you set to false

npm config set strict-ssl=false

Option 2: Load in CA cert, like postman (useful for testing with TLS)

If you have a CA cert already like the poster @kDoyle mentioned then you can configure in each request (thanks @nic ferrier).

 let opts = {
    method: 'GET',
    hostname: "localhost",
    port: listener.address().port,
    path: '/',
    ca: fs.readFileSync("cacert.pem")
  };

  https.request(opts, (response) => { }).end();

Option 3: Use a proper SSL Cert from a trusted source (useful for production)

letsencrypt.org is free, easy to set up and the keys can be automatically rotated. https://letsencrypt.org/docs/

edited Jul 11 '21 at 20:46

HITMAN

538
1
4
13

answered Jul 13 '17 at 18:36

Peter Grainger

4,539
1
18
22

If I understand you correctly, setting that env_var in server will only disable the process of verification, which is something I don't want to do. I need to only do what postman does i.e. to import somehow the certificate. – kDoyle Jul 13 '17 at 19:01
is the value you gave here: ```cert: fs.readFileSync('certificate.crt')``` the absolute location of the cert? – Peter Grainger Jul 14 '17 at 04:22
Also two things you have to think about, the CN needs to be the same as the domain you are trying to use and 2 that your openssl package needs to be 1.0.2+ or you could just use a free CA https://letsencrypt.org/ – Peter Grainger Jul 14 '17 at 04:25
It seems that I misunderstood the rejection. It was meant to be done in client side and everything works like charm. Thank you and I accept the answer. – kDoyle Jul 14 '17 at 17:59
3

I can't believe I finally found something to stop this error. I f'ing tried everything. worked on Jan.31.19, – Anthony Roberts Jan 31 '19 at 22:37
I am getting this error on npm install @angular/fire firebase --save. Is it possible to update the answer to fix all node npm related issues? – Howdy Aug 07 '19 at 18:38
@llaaalu do you mean change the wording of the answer so others who are using something other than node can find it useful? – Peter Grainger Aug 09 '19 at 12:32
Which is better: above NODE_TLS_REJECT_UNAUTHORIZED=0 env variable or below "npm config set strict-ssl=false" solution. Just curious whats more kosher. – armyofda12mnkeys Sep 30 '19 at 20:50
@armyofda12mnkeys I think it depends on your setup. It's easier to add the Environment variable to the source code either as a developer only npm script or when running a docker container so others using your project don't run into the same issue. Setting the npm config is probably better if you aren't in a team or just coding for fun as then you don't need to keep setting it everywhere, you only have to do it once – Peter Grainger Oct 01 '19 at 10:19
it didn't work for me but the spirit is the same, I posted my answer below – GGEv Nov 08 '19 at 14:19
@PeterGrainger, since this is the most up voted answer now, would you please add at the end that for self-signed certs in production, it is best to use the `ca` options property - the way Nic answered it below? I believe this is closer to the Postman workaround mentioned in the question. – Nesho Neshev Mar 21 '21 at 10:15
thanks. option 1 worked for me. npm config set strict-ssl=false – Cloud Man Sep 10 '21 at 18:54
2

THAAAAAAANKKKSSSSS – WISERDIVISOR Jan 26 '22 at 15:18

score 48 · Answer 2 · edited Jan 09 '20 at 05:49

48

You can fix this issue using NODE_TLS_REJECT_UNAUTHORIZED=0 in the terminal or inserting the following line within the JS file.

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0;

Beware that this a hack and it should not be used in production.

If you are using windows then run the following command in the command prompt:

set NODE_TLS_REJECT_UNAUTHORIZED=0

After that, npm install <my-package> will work.

edited Jan 09 '20 at 05:49

vighnesh153

4,354
2
13
27

answered Nov 11 '19 at 11:17

Mukesh Kashyap

701
7
9

5

Should be `process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';` – TheRealFakeNews Aug 15 '20 at 01:49
2

This worked (number), didn't do the string version, I am running node.js on windows. – Wadi Diaz-wong Jan 07 '21 at 20:57
both works, First one (number) worked for me. (centos) – Hari Kishore Nov 18 '21 at 14:55
I am getting error while using SelfSigned cert for ftp on windows and using `ftp` npm module. Is the solution different for it ? – Salim Shamim Dec 06 '21 at 11:56
What would be the equivalent command on MAC? – SymboCoder Apr 13 '23 at 07:01

score 18 · Answer 3 · edited Aug 26 '21 at 10:47

18

You can write command npm config set strict-ssl false

edited Aug 26 '21 at 10:47

Capaj

4,024
2
43
56

answered Feb 23 '18 at 14:33

Arsalan Ahmed Khan

436
4
9

score 18 · Answer 4 · answered Jan 25 '21 at 09:48

18

for Nodemailer:

adding

tls: {
  rejectUnauthorized: false
}

solved my problem.

Overall code looks liek this:

nodemailer.createTransport({
    host: process.env.MAIL_SERVER,
    secure: false,
    port: 587,
    auth: {
      user: process.env.MAIL_USERNAME,
      pass: process.env.MAIL_PASSWORD
    },
    tls: {
      rejectUnauthorized: false
    }
  }

answered Jan 25 '21 at 09:48

Deepak swain

3,380
1
30
26

1

This is exactly what I was looking for. Thanks – imvanzen Sep 23 '21 at 19:21

score 12 · Answer 5 · answered Nov 08 '19 at 14:20

12

you just add at the start of your code this line:

process.env.NODE_TLS_REJECT_UNAUTHORIZED='0'

And everything solved, but in any case it is not recommendable, I am investigating the solution of https://letsencrypt.org/

answered Nov 08 '19 at 14:20

GGEv

843
9
23

3

It works, but I think its a temporary solution only for our app up and running . It gives the following warning Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification. – Badri Paudel May 17 '20 at 13:55

score 11 · Answer 6 · answered Oct 02 '18 at 18:30

Turning off verification is quite a dangerous thing to do. Much better to verify the certificate.

You can pull the Certificate Authority certificate into the request with the ca key of the options object, like this:

let opts = {
    method: 'GET',
    hostname: "localhost",
    port: listener.address().port,
    path: '/',
    ca: await fs.promises.readFile("cacert.pem")
  };

https.request(opts, (response) => { }).end();

I put a whole demo together of this so you can see how to construct SSL tests.

It's here.

score 7 · Answer 7 · answered Jan 27 '21 at 01:08

The node application needs to have the CA certificate added to the existing CA (Mozilla) certificates.

We start node using a service, and add the environment variable, NODE_EXTRA_CA_CERTS

[Service]
Restart=always
User=<...>
Group=<...>
Environment=PATH=/usr/bin:/usr/local/bin
Environment=NODE_ENV=production
Environment=NODE_EXTRA_CA_CERTS=/<...>/.ssl/extra_certs.pem
WorkingDirectory=/<...>

ExecStart=/usr/bin/node -r dotenv/config /<.....>/server.js dotenv_config_path=/<....>/.env

This way we can use the same application to call services using popular CAs or our own self signed certs, and we don't have to turn off SSL checking.

In linux there is an easy way to get the certificate, use this post: Use self signed certificate with cURL?

You create your certificate using:

$ echo quit | openssl s_client -showcerts -servername server -connect server:443 > cacert.pem

then copy that .pem file as the extra_cert.pem. You can only have one pem file, but you can append multiple pem files into one file.

I hope this helps someone, it took me a while to find the different parts to make this work.

This is the best option and does not compromise on security! — st.huber, Oct 13 '21 at 13:48

score 6 · Answer 8 · answered Nov 18 '21 at 18:58

Do:

Better use this if running a node script for standalone purpose,

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0;

Don't:

instead of changing all default request process.

npm config set strict-ssl=false

i.e., don't alter your node config, else it will apply to all your requests, by making it default config. So just use it where necessary.

score 3 · Answer 9 · answered Aug 21 '20 at 22:19

3

For what it's worth, after spending a day and a half trying to track this one down it turned out the error was caused by a setting on my company's firewall that IT had to disable. Nothing anywhere on the internet did anything to fix this.

answered Aug 21 '20 at 22:19

Jonathan

648
4
13
34

What was the thing that your IT had to disable? – RushPL Aug 29 '20 at 23:48

score 0 · Answer 10 · answered May 22 '22 at 15:39

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0; Even though its not worked ...

Not Able to Install Cypress:

S C:\Cypress> export NODE_TLS_REJECT_UNAUTHORIZED='0' node app.js export : The term 'export' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included,
verify that the path is correct and try again. At line:1 char:1

export NODE_TLS_REJECT_UNAUTHORIZED='0' node app.js

  + CategoryInfo          : ObjectNotFound: (export:String) [], CommandNotFoundException   
  + FullyQualifiedErrorId : CommandNotFoundException

nodejs - error self signed certificate in certificate chain

10 Answers10

Option 1: Disable the warning (useful for dev)

Option 2: Load in CA cert, like postman (useful for testing with TLS)

Option 3: Use a proper SSL Cert from a trusted source (useful for production)

Do:

Don't:

Linked