Unable to verify leaf signature

Question

I'm using node.js request.js to reach an api. I'm getting this error

[Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE]

All of my credentials are accurate and valid, and the server's fine. I made the same request with postman.

request({
    "url": domain+"/api/orders/originator/"+id,
    "method": "GET",
    "headers":{
        "X-API-VERSION": 1,
        "X-API-KEY": key
    },
}, function(err, response, body){
    console.log(err);
    console.log(response);
    console.log(body);
});

This code is just running in an executable script ex. node ./run_file.js, Is that why? Does it need to run on a server?

This is a long shot, but could it be that the API is not recognizing the user agent being passed by your node program? — Hector Correa, Nov 19 '13 at 22:01
Hum...also see this: http://blog.gaeremynck.com/fixing-unable_to_verify_leaf_signature/ — Hector Correa, Nov 19 '13 at 22:02
@HectorCorrea I was able to read the api in postman perfectly. Why can't node do it? I tried changing the user agent, no luck. — ThomasReggi, Nov 19 '13 at 22:24

score 171 · Accepted Answer · edited May 18 '18 at 17:24

171

Note: the following is dangerous, and will allow API content to be intercepted and modified between the client and the server.

This also worked

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';

edited May 18 '18 at 17:24

mikemaccana

81,787
73
317
396

answered Nov 20 '13 at 15:51

ThomasReggi

42,912
63
199
343

22

I upmodded this, and thanks for answering, but it's actively harmful to your security. You should add the missing CA per @CoolAJ86's answer below. – mikemaccana Jun 02 '14 at 10:31
4

I am using the NodeJS plugin called `nodemailer` and `nodemailer-smtp-transport` and the same general command worked. You need to add this to your `createTransport` object: `tls:{rejectUnauthorized: false}` – LukeP Sep 15 '14 at 22:03
3

@LukeP equally insecure with nodemailer I guess, though. There's a clue in the name: if something's **Un**authorized, you generally want to reject it, by definition. What you need is to find a way to authorize it correctly (by setting up CA certificates properly, as other answers have already said). – Bruno May 29 '15 at 21:41
@Bruno I agree, you should set it up the right way with certificates. I merely wanted to setup a quick test for a demo so the code I posted is a quick fix. I should have prefaced with that in my comment. – LukeP Jun 03 '15 at 21:48
2

@mikemaccana There is no security problem if the request is on the same server and you are the only owner. – Binar Web May 18 '18 at 11:56
@BinarWeb Correct. I had this error happen, when multiple microservices on the same local developing enviroment "talked" to each other. The certificates were for the actual domains though so they were not valid locally. – DesperateEi May 14 '19 at 11:28
But how can I get the process variable? – nix86 May 05 '20 at 07:26
It should be globally available in node – apoteet Mar 13 '21 at 18:07

Andrei Karpushonak · Answer 2 · 2014-06-02T13:53:09.503

92

It's not an issue with the application, but with the certificate which is signed by an intermediary CA. If you accept that fact and still want to proceed, add the following to request options:

rejectUnauthorized: false

Full request:

request({
    "rejectUnauthorized": false,
    "url": domain+"/api/orders/originator/"+id,
    "method": "GET",
    "headers":{
        "X-API-VERSION": 1,
        "X-API-KEY": key
    },
}, function(err, response, body){
    console.log(err);
    console.log(response);
    console.log(body);
});

edited Jun 02 '14 at 13:53

answered Nov 20 '13 at 09:25

Andrei Karpushonak

8,338
1
36
50

I have this problem right now at work. I submitted an IT ticket telling them SSL may be misconfigured -- they told me I was craZY. Is there any more information I can give them to resolve this issue? – blakev Nov 20 '13 at 18:55
This isn't actually correct: as CoolAJ86 and hectorcorrea mention, the certificate is valid, but it's signed by an intermediary CA. – mikemaccana Jun 02 '14 at 10:27

coolaj86 · Answer 3 · 2019-05-03T17:28:00.750

83

The Secure Solution

Rather than turning off security you can add the necessary certificates to the chain. First install ssl-root-cas package from npm:

npm install ssl-root-cas

This package contains many intermediary certificates that browsers trust but node doesn't.

var sslRootCAs = require('ssl-root-cas/latest')
sslRootCAs.inject()

Will add the missing certificates. See here for more info:

https://git.coolaj86.com/coolaj86/ssl-root-cas.js

Also, See the next answer below

edited May 03 '19 at 17:28

answered Mar 08 '14 at 00:28

coolaj86

64,368
14
90
108

2

Does the Http client not use the Windows Trusted Root Certification Authorities certificate store? – Richard Collette Jul 26 '14 at 16:31
1

node uses the mozilla certs bundled in the binary and it overrides them whenever you supply your own `ca` array. I don't know if its http module will also look to the OS chain. However, curl on OS X seems to only use the OS chain and not allow manually specified certs. – coolaj86 Jul 31 '14 at 04:48
Does this have to be run for each process or can I run it once and update my certificates globally? – Joshua Snider Mar 04 '19 at 16:01
The certificates are stored in potentially two places: (1) built-in to the node.js binary (2) the operating system keystore. If your certs are out of date you will need to include this in your running code. It doesn't change the node binary nor your operating system - just the project folder. – coolaj86 Mar 05 '19 at 23:15
by the way https://github.com/coolaj86/node-ssl-root-cas is not anymore maintained, it sais "node-ssl-root-cas Moved to https://git.daplie.com/Daplie/node-ssl-root-cas" but in the issue Server down #34 https://github.com/Daplie/node-ssl-root-cas/issues/34 in the end sais "This is the real repo: https://git.coolaj86.com/coolaj86/ssl-root-cas.js". – Cavva79 Mar 21 '19 at 07:17
Someone hijacked the redirects to my github projects by creating a spam account with my name. I've contacted github about it and hopefully it will be restored soon, then the links should work again. – coolaj86 Mar 21 '19 at 20:33
I do get this error when trying this in Firebase Functions: `Error: EROFS: read-only file system, open '/srv/node_modules/ssl-root-cas/pems/mozilla-certdata.txt'` Any idea? – Sunkas Mar 13 '20 at 11:57
1

@Sunkas It is exactly what the error messages says. I don't know how to explain it any simpler. It's a read-only file and cannot be edited. – coolaj86 Mar 13 '20 at 17:26

Ferdinand Prantl · Answer 4 · 2014-09-30T21:02:47.187

48

CoolAJ86's solution is correct and it does not compromise your security like disabling all checks using rejectUnauthorized or NODE_TLS_REJECT_UNAUTHORIZED. Still, you may need to inject an additional CA's certificate explicitly.

I tried first the root CAs included by the ssl-root-cas module:

require('ssl-root-cas/latest')
  .inject();

I still ended up with the UNABLE_TO_VERIFY_LEAF_SIGNATURE error. Then I found out who issued the certificate for the web site I was connecting to by the COMODO SSL Analyzer, downloaded the certificate of that authority and tried to add only that one:

require('ssl-root-cas/latest')
  .addFile(__dirname + '/comodohigh-assurancesecureserverca.crt');

I ended up with another error: CERT_UNTRUSTED. Finally, I injected the additional root CAs and included "my" (apparently intermediary) CA, which worked:

require('ssl-root-cas/latest')
  .inject()
  .addFile(__dirname + '/comodohigh-assurancesecureserverca.crt');

edited Sep 30 '14 at 21:02

answered Aug 31 '14 at 10:52

Ferdinand Prantl

3,493
25
29

1

I was connecting to a web site with a certificated issued by the COMODO High-Assurance Secure Server CA. I downloaded the certificate from their [downloads page](https://support.comodo.com/index.php?/Default/Knowledgebase/List/Index/75/instantsslenterprisesslintranetssl). – Ferdinand Prantl Aug 31 '14 at 10:53
2

Thank you! For my issue I needed to add the entire chain of certs to get past this error. For others reference, this post showed me how to easily export the needed pem files via Firefox : http://superuser.com/a/97203 – mfink Jul 09 '15 at 15:20
Well thanks for the help. In my case, in the end it was a bad configuration of the SSL server, not node. Not all the intermediate certs were installed on the server. – Scott Jungwirth Jul 22 '15 at 00:22
if you get the cert as a ```.cer``` run this ```openssl x509 -inform DER -in YOUR_CERTIFICATE.cer -out YOUR_CERTIFICATE.crt``` to convert it t a ```.crt``` beforehand – 0x1gene Oct 26 '16 at 14:49

score 16 · Answer 5 · answered Sep 21 '18 at 20:52

For Create React App (where this error occurs too and this question is the #1 Google result), you are probably using HTTPS=true npm start and a proxy (in package.json) which goes to some HTTPS API which itself is self-signed, when in development.

If that's the case, consider changing proxy like this:

"proxy": {
  "/api": {
    "target": "https://localhost:5001",
    "secure": false
  }
}

secure decides whether the WebPack proxy checks the certificate chain or not and disabling that ensures the API self-signed certificate is not verified so that you get your data.

Simon · Answer 6 · 2019-09-04T21:24:10.340

It may be very tempting to do rejectUnauthorized: false or process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0'; but don't do it! It exposes you to man in the middle attacks.

The other answers are correct in that the issue lies in the fact that your cert is "signed by an intermediary CA." There is an easy solution to this, one which does not require a third party library like ssl-root-cas or injecting any additional CAs into node.

Most https clients in node support options that allow you to specify a CA per request, which will resolve UNABLE_TO_VERIFY_LEAF_SIGNATURE. Here's a simple example using node's built-int https module.

import https from 'https';

const options = {
  host: '<your host>',
  defaultPort: 443,
  path: '<your path>',
  // assuming the bundle file is co-located with this file
  ca: readFileSync(__dirname + '/<your bundle file>.ca-bundle'),
  headers: {
    'content-type': 'application/json',
  }
};
https.get(options, res => {
  // do whatever you need to do
})

If, however, you can configure the ssl settings in your hosting server, the best solution would be to add the intermediate certificates to your hosting provider. That way the client requester doesn't need to specify a CA, since it's included in the server itself. I personally use namecheap + heroku. The trick for me was to create one .crt file with cat yourcertificate.crt bundle.ca-bundle > server.crt. I then opened up this file and added a newline after the first certificate. You can read more at

https://www.namecheap.com/support/knowledgebase/article.aspx/10050/33/installing-an-ssl-certificate-on-heroku-ssl

This bug comes mostly in local environment, not in production, So if you are in local its fine to do : process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0'; — vivex, Nov 22 '19 at 05:41
@Vivex - it's not ok to do that in a local environment if the entire point is to test how your SSL certs work and how they get passed around... — dwanderson, Jan 08 '20 at 18:31

Sharathi RB · Answer 7 · 2018-10-10T08:38:06.057

I had the same issues. I have followed @ThomasReggi and @CoolAJ86 solution and worked well but I'm not satisfied with the solution.

Because "UNABLE_TO_VERIFY_LEAF_SIGNATURE" issue is happened due to certification configuration level.

I accept @thirdender solution but its partial solution.As per the nginx official website, they clearly mentioned certificate should be combination of The server certificate and chained certificates.

score 5 · Answer 8 · answered Mar 03 '20 at 12:35

5

You can also try by setting strictSSL to false, like this:

{  
   url: "https://...",
   method: "POST",
   headers: {
        "Content-Type": "application/json"},
   strictSSL: false
}

answered Mar 03 '20 at 12:35

SUBHAJIT GANGULI

173
2
8

This works if your sending from Node JS application, awesome!! – Ally Makongo Jul 30 '20 at 02:59
Thank you!!! It works for me, wow, after spending so much time... – Nan fish Aug 02 '20 at 22:25

score 2 · Answer 9 · answered Dec 18 '15 at 15:02

Just putting this here in case it helps someone, my case was different and a bit of an odd mix. I was getting this on a request that was accessed via superagent - the problem had nothing to do with certificates (which were setup properly) and all to do with the fact that I was then passing the superagent result through the async module's waterfall callback. To fix: Instead of passing the entire result, just pass result.body through the waterfall's callback.

score 0 · Answer 10 · answered Nov 17 '17 at 18:25

I had an issue with my Apache configuration after installing a GoDaddy certificate on a subdomain. I originally thought it might be an issue with Node not sending a Server Name Indicator (SNI), but that wasn't the case. Analyzing the subdomain's SSL certificate with https://www.ssllabs.com/ssltest/ returned the error Chain issues: Incomplete.

After adding the GoDaddy provided gd_bundle-g2-g1.crt file via the SSLCertificateChainFile Apache directive, Node was able to connect over HTTPS and the error went away.

score 0 · Answer 11 · answered May 22 '19 at 08:12

0

You have to include the Intermediate certificate in your server. This solves the [Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE]

answered May 22 '19 at 08:12

score 0 · Answer 12 · answered Dec 25 '19 at 05:32

Another approach to solving this securely is to use the following module.

node_extra_ca_certs_mozilla_bundle

This module can work without any code modification by generating a PEM file that includes all root and intermediate certificates trusted by Mozilla. You can use the following environment variable (Works with Nodejs v7.3+),

NODE_EXTRA_CA_CERTS

To generate the PEM file to use with the above environment variable. You can install the module using:

npm install --save node_extra_ca_certs_mozilla_bundle

and then launch your node script with an environment variable.

NODE_EXTRA_CA_CERTS=node_modules/node_extra_ca_certs_mozilla_bundle/ca_bundle/ca_intermediate_root_bundle.pem node your_script.js

Other ways to use the generated PEM file are available at:

https://github.com/arvind-agarwal/node_extra_ca_certs_mozilla_bundle

NOTE: I am the author of the above module.

score 0 · Answer 13 · answered May 12 '20 at 14:22

If you come to this thread because you're using the node postgres / pg module, there is a better solution than setting NODE_TLS_REJECT_UNAUTHORIZED or rejectUnauthorized, which will lead to insecure connections.

Instead, configure the "ssl" option to match the parameters for tls.connect:

{
  ca: fs.readFileSync('/path/to/server-ca.pem').toString(),
  cert: fs.readFileSync('/path/to/client-cert.pem').toString(),
  key: fs.readFileSync('/path/to/client-key.pem').toString(),
  servername: 'my-server-name' // e.g. my-project-id/my-sql-instance-id for Google SQL
}

I've written a module to help with parsing these options from environment variables like PGSSLROOTCERT, PGSSLCERT, and PGSSLKEY:

https://github.com/programmarchy/pg-ssl

score -1 · Answer 14 · answered Jul 01 '20 at 11:00

Following commands worked for me :

> npm config set strict-ssl false
> npm cache clean --force

The problem is that you are attempting to install a module from a repository with a bad or untrusted SSL[Secure Sockets Layer] certificate. Once you clean the cache, this problem will be resolved.You might need to turn it to true later on.

Unable to verify leaf signature

14 Answers14

The Secure Solution

Also, See the next answer below

Linked

Related