Correct way to solve UNABLE_TO_VERIFY_LEAF_SIGNATURE

[paul-at]

What's the right approach to fix UNABLE_TO_VERIFY_LEAF_SIGNATURE error (in AWS Lambda if that matters) that happens when connecting to a website with Letsencrypt-issued certificate (ISRG Root X1) with node-fetch?

Solutions I found online (for example, https://stackoverflow.com/questions/20082893/unable-to-verify-leaf-signature) consist of:

1. disabling SSL checks; not great as we're sending API credentials to external APIs with node-fetch
2. adding custom root certificates, which doesn't apply here - it's a standard CA and works fine in browser. I understand that I can find one that I need and add it, but I was hoping to find a more coherent solution to have all CA certs used by node-fetch up-to-date.

I've also tried injecting root certs from a third-party package

var rootCas = require('ssl-root-cas').create();
// default for all https requests
// (whether using https directly, request, or another module)
require('https').globalAgent.options.ca = rootCas;

which didn't make a difference.

Any thoughts?

[btakita]

Have you solved this issue?

[paul-at]

Alas. Found a workaround for the specific use case so that we didn't have to call the server with that cert, but never found a solution.

[gorn]

This is annoying in my case as well. Disabling SSL check did not work ...

[n00dl3]

The correct way to deal with this issue is to download the missing CA certificate(s) in PEM format (you can concatenate them in the file if you need more that one certificate), and set an environment variable NODE_EXTRA_CA_CERTS pointing to that file.

NODE_EXTRA_CA_CERTS=file #
Added in: v7.3.0

When set, the well known "root" CAs (like VeriSign) will be extended with the extra certificates in file. The file should consist of one or more trusted certificates in PEM format. A message will be emitted (once) with process.emitWarning() if the file is missing or malformed, but any errors are otherwise ignored.

Neither the well known nor extra certificates are used when the ca options property is explicitly specified for a TLS or HTTPS client or server.

This environment variable is ignored when node runs as setuid root or has Linux file capabilities set.

The NODE_EXTRA_CA_CERTS environment variable is only read when the Node.js process is first launched. Changing the value at runtime using process.env.NODE_EXTRA_CA_CERTS has no effect on the current process.

Source

I personnally had issue with an intermediate godaddy's CA, so I downloaded the certificate that was unknown, and run my app like this :

export NODE_EXTRA_CA_CERTS=./assets/gdig2.crt.pem
node ./index.js