1

I feel puzzled by the following behavior. In the very beginning of my main index.js, I am using

require('dotenv').config();
console.log(process.env);  // everything seems in order

I know that the rest of my code successfully access all the relevant process.env.${VARS}. However, I get SSL exceptions; exceptions that I can easily solve by

export NODE_EXTRA_CA_CERTS=/some/absolute/path/to/ca.pem
npm start

Is there something special about NODE_EXTRA_CA_CERTS that would explained why this specific variable set with require('dotenv').config() does not work while the others work like a charm?

Does it need to be set before running npm? If it does, why is it the case and are there any workaround so I could keep thing simple?

environement:

  • dotenv 16.0.0
  • node v16.13.2
zar3bski
  • 2,773
  • 7
  • 25
  • 58

1 Answers1

2

neardupe How to properly configure node.js to use Self Signed root certificates? .

Your problem is not in npm. npm start runs your application, typically (but not necessarily) by running node (or whatever spelling on your platform) to run your js code. When you use node to run js, NODE_EXTRA_CA_CERTS is read and saved in the C-code part of node at startup, before beginning to execute js, and subsequent changes in js variables like process.env do not affect it.

The clean way to do this in js is to pass the desired CAlist -- which can consist of the standard list (from tls.rootCertificates) plus any additions (or replacements or deletions) you choose -- in the (relevant) TLS socket creation, or any https request that implicitly creates a TLS socket; or alternatively to use --use-openssl-ca and select an OpenSSL-format store provided by your system (modified if necessary by system means like update-ca-certificates on Debian/Ubuntu) or one you create.

Or when using npm as you do, it should be possible to configure your package.json to set the envvar before running the application in node.

If you can't do either/any of those, especially where you control the toplevel (and startup) but call libraries you can't [safely] change, see the Q I linked above. For https connections that use the default https.globalAgent you can (documentedly) set that per the A. For all connections, you can monkeypatch tls.createSecureContext to use the undocumented context.addCACert as in the Q, which OP confirmed in the A does actually work if using a correct cert.

dave_thompson_085
  • 34,712
  • 6
  • 50
  • 70