`fetch()` fails with `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` while curl and openssl validate the same HTTPS endpoint

[kevgeoleo]

Version

24.13.1

Platform

Linux KContainer 5.10.0-12-amd64 #1 SMP Debian 5.10.103-1 (2022-03-07) x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

Hi,

I would like to report a behavior in Node that can be reproduced using the below PoC:

const req = new Request("https://example.org");

const init = {
  method: "GET",
};

req.headers.set("foo", "bar");

const res = await fetch(req, init);

console.log("Status:", res.status);

How often does it reproduce? Is there a required condition?

No specific condition

What is the expected behavior? Why is that the expected behavior?

Works in Deno and Bun

root@KContainer:~/10396# deno run -A main.mjs
Status: 200
root@KContainer:~/10396# bun run main.mjs
Status: 200

Using curl works

root@KContainer:~/10396# curl -v https://example.org
*   Trying 104.20.26.136:443...
* Connected to example.org (104.20.26.136) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2

What do you see instead?

Fetch fails due to UNABLE_TO_GET_ISSUER_CERT_LOCALLY

root@KContainer:~/10396# node main.mjs
node:internal/deps/undici/undici:16416
      Error.captureStackTrace(err);
            ^

TypeError: fetch failed
    at node:internal/deps/undici/undici:16416:13
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async file:///10396/main.mjs:9:13 {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:internal/tls/wrap:1649:34)
      at TLSSocket.emit (node:events:508:28)
      at TLSSocket._finishInit (node:internal/tls/wrap:1094:8)
      at ssl.onhandshakedone (node:internal/tls/wrap:880:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

Node.js v24.13.1

root@KContainer:~/10396# node -e "fetch('https://example.org').then(r=>console.log(r.status)).catch(console.error)"
TypeError: fetch failed
    at node:internal/deps/undici/undici:16416:13
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:internal/tls/wrap:1649:34)
      at TLSSocket.emit (node:events:508:28)
      at TLSSocket._finishInit (node:internal/tls/wrap:1094:8)
      at ssl.onhandshakedone (node:internal/tls/wrap:880:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

Additional information

No response

[avivkeller]

Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests disable certificate validation, fwiw

[avivkeller]

(cc @nodejs/undici correct me if I am wrong)

[mcollina]

This has nothing to do with undici, more like a certificate resolution issue.

[aduh95]

Can you reproduce with 25.9.0?

[kevgeoleo]

Yes getting the same error in 25.9.0

root@KContainer:~/10396# node -v
v25.9.0
root@KContainer:~/10396# node main.mjs
node:internal/modules/run_main:107
    triggerUncaughtException(
    ^

[TypeError: fetch failed] {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:internal/tls/wrap:1655:34)
      at TLSSocket.emit (node:events:509:20)
      at TLSSocket._finishInit (node:internal/tls/wrap:1101:8)
      at ssl.onhandshakedone (node:internal/tls/wrap:887:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

Node.js v25.9.0

[mcollina]

The problem is that example.org certificate is signed by a chain that ends at AAA Services.

This authority was distrusted (
https://www.sectigo.com/resource-library/enhancements-to-root-ca-and-hierarchies) and removed in #59571.

curl and openssl loads the system CA. Node.js can do the same with --use-system-ca flag.

This can be closed.

[aduh95]

@kevgeoleo can you confirm that starting the script with node --use-system-ca main.js does not reproduce the bug?

Assuming yes, closing as working as intended.