0

We need to implement MTLS on nodejs - client side.

This is my code:

const fs = require('fs')
    , path = require('path')
    , certFile = fs.readFileSync('./client.crt')
    , keyFile = fs.readFileSync('./client.key')
    , caFile = fs.readFileSync('./ca.crt')
    , request = require('request');

const options = {
    url: 'https://my-url',
    cert: certFile,
    key: keyFile,
    ca: caFile
};

request.post(options, (err, res) => {
    console.log(err)
    console.log(res)
});

I'm getting the error self signed certificate in certificate chain, although my CA is not self-signed (we gave the customer the CSR and he gave us back the client.crt + root ca and intermediate certificate)...

Full error:

{ Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (_tls_wrap.js:1138:34)
    at TLSSocket.emit (events.js:188:13)
    at TLSSocket._finishInit (_tls_wrap.js:627:8) code: 'SELF_SIGNED_CERT_IN_CHAIN' }

what could be the problem?

Am I missing something?

Note my ec2 server is behinds ALB that terminates the SSL. The cert files in the EC2 serve are only for making requests to our customer server using MTLS. Should I put the cert files on a certain path?

Adding output for openssl s_client -connect host:port -CAfile ca.crt:

CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization ................
verify return:1
---
Certificate chain
 0 s:/businessCategory=Private Organization ......................
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
... content ...
-----END CERTIFICATE-----
subject=/businessCategory=Private Organization ......
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4571 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ***-RSA-****A384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ....-RSA-....
    Session-ID: ......
    Session-ID-ctx: 
    Master-Key: .......
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1612740765
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

Output for openssl s_client -connect host:port -CAfile ca.crt -CApath /some/nonexistent/directory -state

CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization ...
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
.....
.....
.....
No client certificate CA names sent
Peer signing digest: SHA512
---
SSL handshake has read 4571 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ***4
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : **
    Session-ID: **
    Session-ID-ctx: 
    Master-Key: **
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1612771228
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.