fetch() ignores the "custom CA search paths" of node

[bewue]

Bug Description

If you need to add a custom CA, you seem to have 3 possible solutions, but only the 3rd (not recommended) worked for me.
For solution 1 and 2 i have placed my custom CA certificate at the according locations.

1. --use-openssl-ca
2. NODE_EXTRA_CA_CERTS
3. NODE_TLS_REJECT_UNAUTHORIZED

Reproducible By

Place your custom CA certificate at the according locations.
Try solution 1 or 2 and fetch() to an endpoint with an certificate which was signed by an unknown CA.
The following "unprecise" error message will be thrown: TypeError: fetch failed

Expected Behavior

fetch() should use the same "custom CA search paths" like node itself

Environment

node v18.17.0
Ubuntu 22.04

[mcollina]

Thanks for reporting! Would you like to send a Pull Request to address this issue? Remember to add unit tests.

[silverwind]

The following "unprecise" error message will be thrown: TypeError: fetch failed

More info should be in error.cause, but keep note many error parsers do not process that property.

[mcollina]

That "unprecise" error is mandated by the spec.

[sigorilla]

Can you support NODE_EXTRA_CA_CERTS?

[mcollina]

PRs are welcomed. I don't see why they are not working as it is.

[Uzlopak]

I dont think that this has anything to do with undici. THe CA certs are loaded at node start up. We are basically not in control of those parameters.

[ishan-sharma-me]

I was able to make it work with custom CA by exporting the CA path with the parameter NODE_EXTRA_CA_CERTS and then undici fetch stopped giving the tls error.