Skip to content

UNABLE_TO_GET_ISSUER_CERT_LOCALLY #60284

@jakewaggoner

Description

@jakewaggoner

Version

24.7.0

Platform

Linux c12d480d584b 6.10.10-200.fc40.aarch64 #1 SMP PREEMPT_DYNAMIC Thu Sep 12 18:52:07 UTC 2024 aarch64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

  1. Download the nodeJS Docker image tagged 24.7.0
  2. Create a container and run the following command:
node -e "fetch('https://www.relialabtest.com/').then(res => {  console.log('Status:', res.status);  return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
  1. Observe the error UNABLE_TO_GET_ISSUER_CERT_LOCALLY
  2. Run the following command:
NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt node -e "fetch('https://www.relialabtest.com/').then(res => {  console.log('Status:', res.status);  return res.text();}).then(data => console.log(data)).catch(err => console.error(err));"
  1. Observe it now works

How often does it reproduce? Is there a required condition?

This happens every time.

What is the expected behavior? Why is that the expected behavior?

I expect the request to complete successfully instead of give a TLS error. Since this is just a GET call to a website, I expect to see the HTML of the website.

What do you see instead?

TypeError: fetch failed
    at node:internal/deps/undici/undici:15445:13
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:_tls_wrap:1631:34)
      at TLSSocket.emit (node:events:508:28)
      at TLSSocket._finishInit (node:_tls_wrap:1077:8)
      at ssl.onhandshakedone (node:_tls_wrap:863:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

Additional information

This may only happen with sites that have the a cert signed by the following CA:
Cloudflare TLS Issuing ECC CA 1

This also appears to be happening node Node v22, I believe on version v22.20.0 and later. It seems like node is not getting the system certificates or something since it works just fine if the var NODE_EXTRA_CA_CERTS is set to use the system CA certs found at /etc/ssl/certs/ca-certificates.crt

Metadata

Metadata

Assignees

No one assigned

    Labels

    tlsIssues and PRs related to the tls subsystem.wontfixIssues that will not be fixed.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions