Failed to verify first certificate

Question

I have a directory containing a set of certificates, a Python script, and a Node script. Both scenarios make a GET request to the same URL and come with the same certificate package. The Python script makes the request expected, however the Node script raises this error:

{[Error: Failed to verify the first certificate]: "UNABLE_TO_VERIFY_LEAF_SIGNATURE"}

Python script (Python 3.4.3 and requests library):

import requests print(requests.get(url, verify='/tmp/cert/cacert.pem')) 

Node script (Node 4.2.6 and request library):

 var fs = require('fs'); var request = require('request'); request.get({ url: url, agentOptions: { ca: fs.readFileSync('/tmp/cert/cacert.pem') } }, function (error, response, body) { if (error) { console.log(error); } else { console.log(body); } }); 

Both use the same version of OpenSSL:

 $ python -c 'import ssl; print(ssl.OPENSSL_VERSION)' OpenSSL 1.0.2e-fips 3 Dec 2015 $ node -pe process.versions.openssl 1.0.2e 

I don’t think the problem is with the certificate suite, and I don’t want to disable host verification in Node.

Does anyone know why Node throws this error?

Answer 1

The documentation describes the ca parameter as follows:

ca: a string, buffer, or array of strings or trusted certificate buffers in PEM format. If omitted, several well-known root CAs such as VeriSign will be used. They are used to authorize connections.

Thus, he does not expect a set of CA. However, the fix is ​​simple, just split the node as follows:

 var fs = require('fs'); var request = require('request'); var certs = fs.readFileSync('/tmp/cert/cacert.pem').toString().split("\n\n"); request.get({ url: url, agentOptions: { ca: certs } }, function (error, response, body) { if (error) { console.log(error); } else { console.log(body); } }); 

Answer 2

Perhaps you can use this module, which fixes the problem by downloading certificates commonly used by browsers.

https://www.npmjs.com/package/ssl-root-cas