90

I'm using Mikeal's request (https://github.com/mikeal/request) to make an https request to a server. However, I keep getting an authorization error of CERT_HAS_EXPIRED.

request({
        url: 'https://www.domain.com/api/endpoint',
        strictSSL: false
    }, function(error, response, body) {
        if(!error && response.statusCode == 200) {
            res.json(JSON.parse(body));
        } else {
           res.json(response.statusCode, {'error': 'error'})
        }
});

I've tried setting strictSSL to true and false, both output same error of CERT_HAS_EXPIRED. What is causing this issue and is there any way to fix it in nodejs?

8
  • your URL field is missing a "'" at the end.
    – AMember
    Dec 6, 2013 at 20:49
  • Any chance you can give the endpoint URL?
    – Ryan
    Dec 6, 2013 at 21:30
  • 1
    Have you verified that the server SSL certificate is in fact not expired? Maybe it is time to renew it.
    – Henrik
    Dec 6, 2013 at 21:42
  • Turns out the SSL certificate is expired. Is there anyway I can still make this request, ignore the expired certificate, and get a response?
    – wwwuser
    Dec 8, 2013 at 2:03
  • 2
    How about setting agent: false and strictSSL: false? Dec 14, 2013 at 15:01

8 Answers 8

159

The best way to fix this:

Renew the certificate. This can be done for free using Greenlock which issues certificates via Let's Encrypt™ v2

A less insecure way to fix this:

'use strict';

var request = require('request');
var agentOptions;
var agent;

agentOptions = {
  host: 'www.example.com'
, port: '443'
, path: '/'
, rejectUnauthorized: false
};

agent = new https.Agent(agentOptions);

request({
  url: "https://www.example.com/api/endpoint"
, method: 'GET'
, agent: agent
}, function (err, resp, body) {
  // ...
});

By using an agent with rejectUnauthorized you at least limit the security vulnerability to the requests that deal with that one site instead of making your entire node process completely, utterly insecure.

Other Options

If you were using a self-signed cert you would add this option:

agentOptions.ca = [ selfSignedRootCaPemCrtBuffer ];

For trusted-peer connections you would also add these 2 options:

agentOptions.key = clientPemKeyBuffer;
agentOptions.cert = clientPemCrtSignedBySelfSignedRootCaBuffer;

Bad Idea

It's unfortunate that process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; is even documented. It should only be used for debugging and should never make it into in sort of code that runs in the wild. Almost every library that runs atop https has a way of passing agent options through. Those that don't should be fixed.

3
  • 2
    What do you mean by [selfSignedRootCaPemCrtBuffer]? If I know where it is, how to supply the buffer? Feb 17, 2016 at 9:57
  • 2
    If you created a self-signed cert then you would use the pem version of that same self-issued root certificate as the buffer.
    – coolaj86
    Feb 23, 2016 at 22:39
  • 2
    Any ideas when the certificate is not self signed nor expired, but node is complaining that it is expired?
    – El Yobo
    Jun 1, 2020 at 0:10
90
+50

Add this at the top of your file:

process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

DANGEROUS This disables HTTPS / SSL / TLS checking across your entire node.js environment. Please see the solution using an https agent below.

9
  • 48
    Please unmark this as the solution. It is dangerous.
    – coolaj86
    Nov 19, 2015 at 6:45
  • 56
    Every time you use this dis-solution an NSA agent gets its wings.
    – coolaj86
    Nov 19, 2015 at 6:47
  • 18
    @CoolAJ86 There are valid situations to use this. Right now I'm waiting for an expired SSL certificate on a development API server to be updated. It is impeding my ability to do work, and this is a perfectly fine situation to just ignore the SSL issue in the interim.
    – user372743
    Jan 11, 2017 at 14:42
  • 10
    @CoolAJ86 For my use-case, for which you lack all context, it is not applicable. Sorry, but your fundamentalism is not helping.
    – user372743
    Jan 16, 2017 at 14:54
  • 6
    @CoolAJ86 If I have a local application that only makes an HTTPS connection to a staging server in a local environment, there is absolutely no functional difference. Therefore this is an acceptable solution.
    – user372743
    Jan 18, 2017 at 15:40
70

If someone is having this issue today while using an old version of nodejs, this might be due to Lets's encrypt 30th sept. 2021 ROOT CA expiry already mentionned in this answer.

certificates are hardcoded in node source code and the new ISRG Root X1 certificate was only added in this commit.

One can either update their node version, use node --use-openssl-ca flag (assuming openssl certificates are up to date), use the http agent solution mentionned in other answers (I didn't test it), or set process.env.NODE_TLS_REJECT_UNAUTHORIZED = 0 as a quick and dirty workaround.

3
  • 3
    An update of Node.js (in my case to the latest stable version v16.10.0) did the trick! I'm not sure, though, whether you picked the right commit, @max-akn, as my previous version was v8.17.0 and the commit you shared seems to be included from v8.0.0 onwards. Oct 1, 2021 at 12:28
  • Our production app is runnig on Heroku (Heroku-20 stack) and using Node 8.9.4. Also we use Angular 5.2.11 and Angular Universal for server-side rendering. Starting from October 1st 2021 our Angular Universal https requests suddenly stopped working and our pages were not rendering server-side.Simply by adding the "node --use-openssl-ca" flag in our package.json "start" script solved the problem: "start": "set NODE_ENV=production&& node --use-openssl-ca server.js" Thank you @Max Akn! Oct 14, 2021 at 11:49
  • Thank you so much - this solved a problem I've been stuck on for a while. My code is initiated by a piece of legacy code which requires node v8. To solve this I installed node v14.18.2 using n, then set the system's node version back to v8 using n again. However once v14 was installed I could then call this directly with $(n bin 14.18.2) index.js
    – Tom Bailey
    Jan 29, 2022 at 18:52
37

Here is a more concise way to achieve the "less insecure" method proposed by CoolAJ86

request({
  url: url,
  agentOptions: {
    rejectUnauthorized: false
  }
}, function (err, resp, body) {
  // ...
});
1
  • 2
    If you import request from https then you don't even need agentOptions: rejectUnauthorized can be a property directly on the object passed to request. Apr 2, 2020 at 5:15
15

I think the strictSSL: false should (should have worked, even in 2013) work. So in short are three possible ways:

  1. (obvious) Get your CA to renew the certificate, and put it on your server!
  2. Change the default settings of your request object:

    const myRequest = require('request').defaults({strictSSL: false})

    Many modules that use node-request internally also allow a request-object to be injected, so you can make them use your modified instance.
  3. (not recommended) Override all certificate checks for all HTTP(S) agent connections by setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED=0 for the Node.js process.
1
  • 1
    The 3. just saved me from monkey patching kibana 5 for plugin install through a MITM proxy with SSL interception.
    – Tensibai
    Mar 29, 2017 at 8:40
1

Updating Nodejs will force request's cache to be flushed.

This worked for me when nothing else did.

1
  • This tipped me off to the solution for me. The certificate expired error started showing up after I installed NVM. Switching versions eliminated the error.
    – Bing
    Jan 10 at 3:45
0

Try to temporarily modify request.js and harcode everywhere rejectUnauthorized = true, but it would be better to get the certificate extended as a long-term solution.

0

You can do all your Slack requests with a custom slack SSL certificate. You need to download the slack SSL .pem file from the Slack website.

const { request, token, variables } = props;
//Slack certificate adding to request.
//Don't remove this part required for slack request
const certPath = `${auth.slack.certificatePath}/slack-ssl-certificate-2023-03-17.pem`;
const sslCert = fs.readFileSync(certPath);
const agent = new https.Agent({
  ca: sslCert,
  rejectUnauthorized: true
});

const client = new WebClient(token, {
  agent
});

const result = await client.apiCall(request, {
  ...variables,
});

return {
  status: 200,
  result,
  error: '',
};

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.