Fix Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE in Node.js

This error means Node.js cannot verify the SSL/TLS certificate presented by the server because the certificate chain is incomplete or the CA is not trusted. Fix it by providing the full certificate chain, setting the correct CA bundle, or ensuring your Node.js version has up-to-date root certificates.

Reading the Stack Trace

Here's what each line means:

• at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34): The TLS handshake completed but certificate verification failed because the chain could not be validated.
• at ssl.onhandshakedone (node:_tls_wrap:871:12): The SSL handshake finished at the protocol level but trust verification rejected the certificate.
• at Request._callback (src/services/apiClient.js:45:14): Your API client at line 45 made an HTTPS request to a server with an incomplete certificate chain.

Common Causes

const https = require('https');
https.get('https://api.example.com/data', (res) => {
  // Fails because server doesn't send intermediate cert
});

const axios = require('axios');
axios.get('https://internal-api.corp.com/data');
// Internal CA is not in Node's trusted CA store

process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; // INSECURE

The Fix

Provide the internal CA certificate to the HTTPS agent so Node.js can verify the server's certificate chain. Keep rejectUnauthorized: true to maintain security while trusting the internal CA.

const axios = require('axios');

async function fetchData() {
  const response = await axios.get('https://internal-api.corp.com/data');
  return response.data;
}

const axios = require('axios');
const https = require('https');
const fs = require('fs');
const path = require('path');

const caCert = fs.readFileSync(path.resolve(__dirname, '../certs/internal-ca.pem'));

const httpsAgent = new https.Agent({
  ca: caCert,
  rejectUnauthorized: true,
});

async function fetchData() {
  const response = await axios.get('https://internal-api.corp.com/data', {
    httpsAgent,
  });
  return response.data;
}

Testing the Fix

const axios = require('axios');
const { fetchData } = require('./apiClient');

jest.mock('axios');

describe('fetchData', () => {
  it('returns data from the API', async () => {
    axios.get.mockResolvedValue({ data: { result: 'ok' } });
    const data = await fetchData();
    expect(data.result).toBe('ok');
  });

  it('passes httpsAgent with custom CA', async () => {
    axios.get.mockResolvedValue({ data: {} });
    await fetchData();
    const callArgs = axios.get.mock.calls[0];
    expect(callArgs[1]).toHaveProperty('httpsAgent');
  });

  it('throws on connection failure', async () => {
    axios.get.mockRejectedValue(new Error('UNABLE_TO_VERIFY_LEAF_SIGNATURE'));
    await expect(fetchData()).rejects.toThrow('UNABLE_TO_VERIFY_LEAF_SIGNATURE');
  });
});

Run your tests:

npm test

Pushing Through CI/CD

git checkout -b fix/nodejs-tls-certificate-error,git add src/services/apiClient.js src/services/__tests__/apiClient.test.js,git commit -m "fix: provide custom CA certificate for internal API TLS verification",git push origin fix/nodejs-tls-certificate-error

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
      - run: npm run lint

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

npm install bugstack-sdk

const { initBugStack } = require('bugstack-sdk')

initBugStack({ apiKey: process.env.BUGSTACK_API_KEY })

Deploying the Fix (Manual Path)

1. Obtain the correct CA certificate or intermediate certificate chain.
2. Store the CA cert file securely and include it in the deployment.
3. Update the HTTPS agent to use the CA cert with rejectUnauthorized: true.
4. Run tests and verify the connection works.
5. Open a PR, merge after CI passes, and verify in staging.

Frequently Asked Questions