I'm trying to make a request with axios to an api endpoint and I'm getting the following error: Error: unable to verify the first certificate
It seems the https module, which axios uses, is unable to verify the SSL certificate used on the server.
When visiting the server with my browser, the certificate is valid and I can see/download it. I can also make requests to the api on my browser through https.
I can work around it by turning off verification. This code works.
const result = await axios.post(
`https://${url}/login`,
body,
{
httpsAgent: new https.Agent({
rejectUnauthorized: false
})
}
)
Problem is, this doesn't verify the SSL certificate and therefore opens up security holes.
How can I configure axios to trust the certificate and correctly verify it?
Old question but chiming in for those who land here. No expert. Please consult with your local security gurus and what not.
Axios is an http(s) client and http clients usually participate in TLS anonymously. In other words, the server accepts their connection without identifying who is trying to connect. This is different then say, Mutual TLS where both the server and client verify each other before completing the handshake.
The internet is a scary place and we want to protect our clients from connecting to spoofed public endpoints. We do this by ensuring our clients identify the server before sending any private data.
// DO NOT DO THIS IF SHARING PRIVATE DATA WITH SERVICE
const httpsAgent = new https.Agent({ rejectUnauthorized: false });
This is often posted (and more egregiously upvoted) as the answer on StackOverflow regarding https client connection failures in any language. And what's worse is that it usually works, unblocks the dev and they move on their merry way. However, while they certainly get in the door, whose door is it? Since they opted out of verifying the server's identity, their poor client has no way of knowing if the connection they just made to the company's intranet has bad actors listening on the line.
If the service has a public SSL cert, the https.Agent usually does not need to be configured further because your operating system provides a common set of publicly trusted CA certs. This is usually the same set of CA certs your browser is configured to use and is why a default axios client can hit https://google.com with little fuss.
If the service has a private SSL cert (self signed for testing purposes or one signed by your company's private CA to protect their internal secrets), the https agent must be configured to trust the private CA used to sign the server cert:
const httpsAgent = new https.Agent({ ca: MY_CA_BUNDLE });
where MY_CA_BUNDLE is an array of CA certs with both the server cert for the endpoint you want to hit and that cert's complete cert chain in .pem format. You must include all certs in the chain up to the trust root.
Where are these options documented?
HTTPS is the HTTP protocol over TLS/SSL. In Node.js this is implemented as a separate module.
Therefore options passed to the https.Agent are a merge of the options passed to tls.connect() and tls.createSecureContext().
Create a custom agent with SSL certificate:
const httpsAgent = new https.Agent({
rejectUnauthorized: false, // (NOTE: this will disable client verification)
cert: fs.readFileSync("./usercert.pem"),
key: fs.readFileSync("./key.pem"),
passphrase: "YYY"
})
axios.get(url, { httpsAgent })
// or
const instance = axios.create({ httpsAgent })
From https://github.com/axios/axios/issues/284
For me, when my application is running in development mode, I have disabled rejectUnauthorized directly in axios.defaults.options. This works very well. be careful and use this only in developer mode.
import https from 'https'
import axios from 'axios'
import config from '~/config'
/**
* Axios default settings
*/
axios.defaults.baseURL = config.apiURL
/**
* Disable only in development mode
*/
if (process.env.NODE_ENV === 'development') {
const httpsAgent = new https.Agent({
rejectUnauthorized: false,
})
axios.defaults.httpsAgent = httpsAgent
// eslint-disable-next-line no-console
console.log(process.env.NODE_ENV, `RejectUnauthorized is disabled.`)
}
These configuration worked for me (In a Mutual Authentication scenario).
const httpsAgent = new https.Agent({
ca: fs.readFileSync("./resource/bundle.crt"),
cert: fs.readFileSync("./resrouce/thirdparty.crt"),
key: fs.readFileSync("./resource/key.pem"),
})
Note: bundle.crt was prepared from provided certificates (root,intermediate,end entry certificate). Unfortunately no clear documentation found in this regards.
This is very dirty, but at the top of your script, just put:
process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';
This basically tells node to not check SSL certificates, which is very convenient when you get self signed certificates rejected in development.
Please don't use this in production.
This what worked for me , using axios with nodejs + express
exports.test_ssl = async (req,res) => {
let cert_file = fs.readFileSync("./ssl/my_self_signed_certificate.crt")
let ca_file = fs.readFileSync("./ssl/my_self_signed_certificate_ca.crt")
const agent = new https.Agent({
requestCert: true,
rejectUnauthorized: true,
cert: cert_file,
ca: ca_file
});
const options = {
url: `https://51.195.45.154/test`, // <---this is a fake ip do not bother
method: "POST",
httpsAgent : agent,
headers: {
'Accept': 'application/json',
'Content-Type': 'application/txt;charset=UTF-8'
},
data: {}
};
console.log(cert_file.toString())
axios(options)
.then(response => {
payload = response.data ;
return res.status(200).send({"status":1});
}).catch(err => {
console.log(err);
return false
});
}
This worked for me:
import axios from 'axios'
import https from 'https'
const headers = {};
const httpsAgent = new https.Agent({
ca: fs.readFileSync('./certs/cert.pem'),
cert: fs.readFileSync('./certs/cert.pem'),
})
const data = await axios.get(url, { httpsAgent, headers })
const https = require('https');
const axios = require('axios')
const CA = "-----BEGIN CERTIFICATE-----$$$$$-----END CERTIFICATE-----"
const url = "bla"
const httpsAgent = new https.Agent({
ca: CA
});
const response = await axios.get(url, { httpsAgent });
This is what work for me.
Good morning dear.
My problem is the following:
"Enable to verify the first certificate" with an error code 'ENABLE_TO_VERIFY_LEAF_SIGNATURE'.
They sent me a certificate with a .pfx extension and with the following commands I generated the .pem certificate and the key also with a .pem extension.
I attach the commands.
openssl pkcs12 -in certificate.pfx -nocerts -out key.pem -nodes
openssl pkcs12 -in certificate.pfx -nokeys -out certificate.pem
It should be noted that I am using axios to make the request.
I attach my agent configuration in axios.
const httpsAgent = new https.Agent ({
pfx: fs.readFileSync ("path.pfx"),
passphrase: 'password',
requestCert: true,
rejectUnauthorized: true
});
I am using nodejs in Ubuntu. and i want to disable the SSL 3.0 and TLS v1.0 both.
Here is my code
var constants = require('constants')
, https = require('https')
, path = require('path')
, tls = require('tls')
, fs = require('fs');
var sslOptions = {
key: fs.readFileSync('/etc/ssl/private/private.key'),
secureProtocol: 'SSLv23_server_method',
secureOptions: constants.SSL_OP_NO_SSLv3,
secureOptions: constants.SSL_OP_NO_TLSv1,
cert: fs.readFileSync('/etc/ssl/certs/STAR_mycert.crt'),
ca: [
fs.readFileSync('/etc/ssl/certs/AddTrustExternalCARoot_1.crt'),
fs.readFileSync('/etc/ssl/certs/AddTrustExternalCARoot_2.crt'),
fs.readFileSync('/etc/ssl/certs/AddTrustExternalCARoot_3.crt')
],
//ca: fs.readFileSync('/etc/ssl/certs/AddTrustExternalCARoot.crt'),
requestCert: false,
rejectUnauthorized: false
};
Now when i test my website on digicert i got following issue
any idea how to do this?
I don't know much about node.js but I think that you last secureOptions simply overrides the first one because you cannot have the same key multiple times in a dictionary. Since the underlying TLS stack (OpenSSL) requires that the options are combined with bitwise or try the following instead:
secureOptions: constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_TLSv1,
The accepted answer is undocumented. As of Node.js v6.3.0, there actually is a documented constants attribute inside the crypto module which should be used.
...
const { constants } = require('crypto')
https.createServer({
secureOptions: constants.SSL_OP_NO_TLSv1
}, app).listen(443)
...
I tried to configure server with https. On local server, the local private key and certificate works. The code is:
var https = require('https');
const options = {
key: fs.readFileSync('./privatekey.key'),
cert: fs.readFileSync('./certificate.crt')
};
var server = https.createServer(options, app);
But when I purchased a SSL certificate and try to use it on the AWS server, it didn't work at all.
var https = require('https');
const options = {
key: fs.readFileSync('privatekey.pem'),
cert: fs.readFileSync('./ssl/portal.crt'),
ca: [fs.readFileSync('./ssl/portal.ca-bundle')]
};
It always showed webpage is not available. I also tried to upload the server certificate to AWS configuration, still failed. Does anyone know how to fix this?
Background:
I'm trying to communicate between a server and one (should be able to be multiple - hence the need of a CA) client through TLS.
Each node has a certificate that is signed with a common CA.
The CA is in turn self-signed.
The private key of each node is exported as key.pem.
The certificate of each node is exported as certificate.crt.
The CA certificate is exported as ca.crt.
The certificates are not bundled, just exported as is.
The server uses the following setup:
var tls = require("tls");
var fs = require("fs");
var options = {
key: fs.readFileSync("keys/key.pem", "utf8"),
cert: fs.readFileSync("keys/certificate.crt", "utf8"),
requestCert: true,
rejectUnauthorized: true,
ca: [fs.readFileSync('keys/ca.crt')]
}
var server = tls.createServer(options, function(res) {
console.log("Client connected");
console.log('Client connected',
res.authorized ? 'authorized' : 'unauthorized');
res.write("Hello World!");
res.setEncoding("utf8");
res.pipe(res);
}).listen(3000);
The client uses the following setup:
var tls = require("tls");
var fs = require("fs");
var options = {
key: fs.readFileSync("keys/key.pem", "utf8"),
cert: fs.readFileSync("keys/certificate.crt", "utf8"),
requestCert: true,
rejectUnauthorized: true,
ca: [fs.readFileSync('keys/ca.crt')]
}
var client = tls.connect(3000, options, function(){
console.log("Connected to server");
console.log(client.authorized ? "Authorized" : "Not authorized");
});
client.on("data", function(data){
console.log("Received from server", data);
client.end();
});
Note on keys / certificates:
The keys and certificates are generated with the openssl GUI / manager XCA.
The tree looks as follows:
The problem:
As you can see I am using explicit client certificate authentication and I want to disallow any non-permitted connections.
The problem with this is that the client is not able to connect, even though all the certificates come from the same CA.
The error I get from both the server (when a client connects) and the client(when it connects) is:
Error: socket hang up, code: ECONNRESET
If I disable rejectUnauthorized the client can connect, but res.authorized returns false.
What is causing authorised clients to not being able to be authenticated?
Your code is fine. I expect there is a problem with your certificates. The fact that there is no expiry date sticks out to me. I have found this OpenSSL Certificate Authority by Jamie Nguyen to be very useful.
Remember that Nodejs does not support multiple certificates in one cert file, so if you are following the guide, there is no need to copy the root ca and intermediate ca into one file. You will have to add them as separate file entries in the ca list argument.
Afaik the xca tool is build on openssl, so might be able to map the commands in openssl to xca.
Recently I bought a ssl certification
Now I have 5 files:
1) COMODORSADomainValidationSecureServerCA.crt
2) COMODORSAAddTrustCA.crt
3) AddTrustExternalCARoot.crt
4) www_photoshooter_gr.crt
5) key.key (which is the private key)
I know that I have to create an https nodejs server like this sample
var https = require('https');
var fs = require('fs');
var opts = {key: fs.readFileSync('key.pem'),
cert: fs.readFileSync('cert.pem')};
https.createServer(opts, function (req, res) {
res.end('secured!');
}).listen(4443);
but I don't have .pem files!!! How can I create them?
I do it like so :
var server = https.createServer({
key: fs.readFileSync('secret/server.key'),
cert: fs.readFileSync('secret/server.crt'),
ca: fs.readFileSync('secret/ca.crt'),
requestCert: true, rejectUnauthorized: false
}, app);
Where app is an Express app.
You can replace server.key with key.key, server.crt with www_photoshooter_gr.crt and ca.crt with COMODORSADomainValidationSecureServerCA.crt