UNABLE_TO_GET_ISSUER_CERT_LOCALLY when testing locally with SSL

[zomars]

Description 🐜

I have a local setup that allows me to use domains with HTTPS by default ex (https://example.localhost) using Caddy and dnsmasq.

A normal NextJS project works just fine. But when using a project with next-auth we get this error:

[next-auth][error][client_fetch_error]
https://next-auth.js.org/errors#client_fetch_error csrf FetchError: request to https://example.localhost/api/auth/csrf failed, reason: unable to get local issuer certificate
    at ClientRequest.<anonymous> (/Users/zomars/Sites/example/node_modules/node-fetch/lib/index.js:1461:11)
    at ClientRequest.emit (events.js:400:28)
    at ClientRequest.emit (domain.js:470:12)
    at TLSSocket.socketErrorListener (_http_client.js:475:9)
    at TLSSocket.emit (events.js:400:28)
    at TLSSocket.emit (domain.js:470:12)
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:82:21) {
  type: 'system',
  errno: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
}
10:50:25.140 timeZoneName DEBUG [error] server side logged this: Error: Error serializing `.csrfToken` returned from `getServerSideProps` in "/auth/login".
Reason: `undefined` cannot be serialized as JSON. Please use `null` or omit this value.
10:50:25.141 timeZoneName INFO [error] return props,
{
  statusCode: 500,
  hasGetInitialPropsRun: true
}

Is this a bug in your own project?

No

How to reproduce ☕️

• Run a secure server with caddy:
  caddy reverse-proxy --from example.localhost --to localhost:3000
• Setup NEXTAUTH_URL
NEXTAUTH_URL='https://example.localhost/api/auth'
• Try to login and see the error in the logs.

Screenshots / Logs 📽

No response

Environment 🖥

System:
OS: macOS 11.6.2
CPU: (8) x64 Intel(R) Core(TM) i7-4850HQ CPU @ 2.30GHz
Memory: 659.78 MB / 16.00 GB
Shell: 5.8 - /bin/zsh
Binaries:
Node: 14.17.6 - ~/.nvm/versions/node/v14.17.6/bin/node
Yarn: 1.22.10 - /usr/local/bin/yarn
npm: 6.14.15 - ~/.nvm/versions/node/v14.17.6/bin/npm
Browsers:
Brave Browser: 96.1.33.106
Chrome: 96.0.4664.110
Chrome Canary: 84.0.4136.1
Firefox: 72.0.2
Firefox Developer Edition: 96.0
Safari: 15.2
Safari Technology Preview: 15.4
npmPackages:
next: ^12.0.7 => 12.0.7
next-auth: ^3.29.0 => 3.29.0
react: ^17.0.2 => 17.0.2

Contributing 🙌🏽

Yes, I am willing to help solve this bug in a PR

[zomars]

A possible workaround is to set this on next.config.js

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Althought I don't this is a viable solution.

[balazsorban44]

I don't see how we could do anything about this. Your workaround seems to be the correct solution in this case.

[natsandbox]

A possible workaround is to set this on next.config.js

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Althought I don't this is a viable solution.

Why does this work around works?

It doesn't seem safe, so I want to figure out what is happening to find the best practice solution

[hellofaiz]

try to use :-
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

But Setting NODE_TLS_REJECT_UNAUTHORIZED=0 is generally not recommended, as it disables SSL certificate validation and could potentially expose your application to security risks. It's usually better to address the underlying SSL certificate issues rather than bypassing them.

[felipe2g]

A possible workaround is to set this on next.config.js

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Althought I don't this is a viable solution.

Works perfectly here!

[mingster]

brew install openssl will do, if you're on macos.

[lhapaipai]

Node does not use the system root store, your Caddy CA cert is not recognized. you need to manually add this with NODE_EXTRA_CA_CERTS.

Find your CA certificate in the correct directory (/usr/local/share/ca-certificates or ~/.local/share/caddy)

export NODE_EXTRA_CA_CERTS="/usr/local/share/ca-certificates/Caddy_Local_Authority_-_2023_ECC_Root_xxx.crt"
node app.js

[Gr3at]

A possible workaround is to set this on next.config.js

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Althought I don't this is a viable solution.

Seems like we have to choose between:

1. Quick and dirty solution above.
2. Clean add production safe solution below.

Thank you both for your inputs.

Node does not use the system root store, your Caddy CA cert is not recognized. you need to manually add this with NODE_EXTRA_CA_CERTS.

Find your CA certificate in the correct directory (/usr/local/share/ca-certificates or ~/.local/share/caddy)

export NODE_EXTRA_CA_CERTS="/usr/local/share/ca-certificates/Caddy_Local_Authority_-_2023_ECC_Root_xxx.crt"
node app.js

[qtsd]

It appears that the following also works : NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
Reference: https://gist.github.com/julianlam/1cbc48911d4ee5b2b7c42364978664f5.

[gthomas3]

Spent some time fighting this. For me piping the cert path into the dev script did the trick.

I'm running a turbo monorepo, and it has to be within the /app/*/package.json making the respective requests, not the root package.json dev script.

package.json:

  "scripts": {
    "dev": "NODE_EXTRA_CA_CERTS=\"$HOME/Library/Application Support/Caddy/pki/authorities/local/root.crt\" next dev -p 3001",