3

I am getting a DEPTH_ZERO_SELF_SIGNED_CERT error in NextJS, but I'm not using self signed certs?

I have the following stack:

  • NextJS - Frontend
  • Flask - Backend
  • MySQL
  • Nginx

All deployed through docker.

My frontend is located at https://example.com My backend is located at https://backend.example.com

I have used letsencrypt for certs in both cases. When I visit the frontend or backend directly in a browser (chrome), the browser is happy with both their certs.

The problem arises when I try to proxy the backend thru NextJS. I do this with the following next.config.js file.

next.config.js

/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
}

module.exports = nextConfig

module.exports = {
  async rewrites() {
    return [
      {
        source: '/backend/:path*',
        destination: `https://backend.example.com/:path*`, // Proxy to Backend
      },
    ]
  },
}

Now if I try to access the backend as proxied through NextJS (e.g. https://example.com/backend/users), I get the following error:

Error: self-signed certificate
     at TLSSocket.onConnectSecure (node:_tls_wrap:1534:34)
     at TLSSocket.emit (node:events:513:28)
     at TLSSocket._finishInit (node:_tls_wrap:948:8)
     at ssl.onhandshakedone (node:_tls_wrap:729:12) {
   code: 'DEPTH_ZERO_SELF_SIGNED_CERT'

Is there something more to this error than just self-signed certs?

  • I made sure the certs for the frontend and backend have distinct distinguished names (per this question)
  • I've tried setting NODE_TLS_REJECT_UNAUTHORIZED = '0'. Didn't work but not a real solution anyways.

output from openssl s_client --connect backend.example.com:443

CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = backend.example.com
verify return:1
---
Certificate chain
 0 s:CN = backend.example.com
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFKzCCBBOgAwIBAgISBJYxKsxWFSumQqRTPNkOjI3LMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA4MDEyMTI4NDNaFw0yMjEwMzAyMTI4NDJaMB4xHDAaBgNVBAMT
E2JhY2tlbmQuZmxhdXRvLnRlY2gwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC1htNFK15+dqN1+TbITVr2cfB3PjLXBKs58fFBs8DlcduHR09P5eyjBEca
J2TKBjE/mhrCyxXQ00FcVsnHcIZIgpg2YOhVjz7IeH4FcZ97ge/s2m7du7pMpjrd
Stso32iR0LM+qnew7R8Ja+MIEBZlbFXjxXSx/eBkU+SMoz5xvc+ZsxfFsXqFgpt0
sIHXpkXI/HroKRZFOPXFMWenswCzVDjx7+PK3LXkoM1q6EKW7ImV2FjZ25jKy9mq
I//HZmKlPowLc1murp1YI/pomoXLVBWEjW1Q83OgjMRTTU7dolnlVCzmHdvCTzWU
cOKLCab/pvkPr+XA3XQr1/yGrxT9AgMBAAGjggJNMIICSTAOBgNVHQ8BAf8EBAMC
BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAw
HQYDVR0OBBYEFCc08QiMGNTPi4abCWdg5+DhE0FAMB8GA1UdIwQYMBaAFBQusxe3
WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0
cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5j
ci5vcmcvMB4GA1UdEQQXMBWCE2JhY2tlbmQuZmxhdXRvLnRlY2gwTAYDVR0gBEUw
QzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDov
L2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgBG
pVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAYJbhpnEAAAEAwBHMEUC
IQDw/hvNAlNXcvpHEjrJBxiNgLe6PC1z8ZKb1NUwZ+Ac2QIgU9393T4JYZV5LQRe
S+Bad9MxQ+serf4rzJfMhLBik9IAdQBByMqx3yJGShDGoToJQodeTjGLGwPr60vH
aPCQYpYG9gAAAYJbhpumAAAEAwBGMEQCIEbwT4Sg/h0/6s+UT/eLa4jH6Y6Im1Wa
tdtctlWwmDgtAiAoaRwYO0xcUQyQiVQCmg5YbIal+W8TpDhR6rORbwTn7DANBgkq
hkiG9w0BAQsFAAOCAQEAcCQC4+r9JNTood9TwxViXEXJqa/BdQZ2+y8+cqaiN5C/
Kkr0qmrQsVJSBxCQnhlpBqt8DkfDDTkfGkOG2JEaiRhWcfnFGBK4m0xDf5VriCkE
2ohn0V41e/7AdjR0O9RncnfArmrB8Vc5sikX3hi6Tz/7/jtH0xqV1UCE6GPRlu4L
G0UloXyKtg2cindhMjDYKJxLVKrnnpYbFqIdLmomI6lFaf7Chj7Vo7bEMgVRsbvH
n3BO15EhGhOZ67ok6FiXXDX+GoFdEzzSFJ6itiVwAyt0veAhCfs3t1acqAoUSmcn
CPTWgtjMr6C7jwcgywrpkA2L+VwYT6J7vd07485IGw==
-----END CERTIFICATE-----
noslenkwah
  • 1,702
  • 1
  • 17
  • 26
  • Show the certificate. You can by connecting with `openssl s_client` or other HTTP clients. Maybe you are not receiving the one you expect to receive. – Patrick Mevzek Aug 02 '22 at 16:16
  • I've added the certificate. It looks like its the correct one. Is there any reason why when being proxied through NextJS that a different certificate would be used? – noslenkwah Aug 02 '22 at 16:34
  • Are you using OpenSSL 1.1.1 or higher? (Many people are because lower versions are no longer supported free upstream.) If so, add `-noservername` to your `s_client` and check you still get the correct cert chain. (@PatrickMevzek) – dave_thompson_085 Aug 02 '22 at 18:29
  • I'm using `OpenSSL 1.1.1f 31 Mar 2020`. When I add `-noservername` I still get the correct cert chain. – noslenkwah Aug 02 '22 at 18:56

1 Answers1

0

maybe this late, but I found solution here: https://code-specialist.com/cloud/nextjs-self-signed

..."scripts": {
    "dev": "NODE_TLS_REJECT_UNAUTHORIZED=0 next dev",
    ...
},

...

hope this help

Hung Vi
  • 11
  • 1