Trusting Self signed Certs?

[Chris Cantu‏]

I am using rest.js along with restify.js.  I am using rest.js in NodeJS. 

I am running into an issue where I am integrating with an API which includes a self signed cert.  RestJS throws an error and includes this message, 'SELF_SIGNED_CERT_IN_CHAIN. I am wondering if there is a flag I can set in order to overcome this error.

Thanks for your help.

Chris

[Scott Andrews‏]

Chris,

rest.js relies heavily on the facilities in it's host environment for the low level mechanics of establishing this socket and actually sending the HTTP request. The purpose of rest.js is to manage the content of the requests.

With the caveat that I have not worked with SSL on node, here are a couple possible approaches:

1. trust the certificate in question

The docs are a little sparse on how to do this globally, surely there is a way...

To make the change per request, will require a bit a work, but it's doable. You can create your own fork of the node client `rest/client/node` in that fork you'll need to add a 'ca' property to the options object (https://github.com/cujojs/rest/blob/master/client/node.js#L94). The node docs for the 'ca' property are at http://nodejs.org/api/tls.html#tls_tls_connect_options_callback.

To use your custom client, you can chain interceptors off of it just like the default client returned from `require('rest')`. The other option is to make that client the new default client for all rest.js requests:

    rest.setDefaultClient(yourNewClient);

I may consider adding support for the 'ca' property directly in the node client. (i.e. if you yell at me loudly enough)

2. disable SSL verification (please don't do this)

Add this to your env `NODE_TLS_REJECT_UNAUTHORIZED=0` to disable SSL certificate verification. Again, please don't do this except is a very controlled environment, SSL verification is what ensures you're talking to your bank, and not the NSA pretending to be your bank (not that they would do such a thing)

Let me know how it goes.

-Scott

--
You received this message because you are subscribed to the Google Groups "cujojs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cujojs+un...@googlegroups.com.
To post to this group, send email to cuj...@googlegroups.com.
Visit this group at http://groups.google.com/group/cujojs.
To view this discussion on the web visit https://groups.google.com/d/msgid/cujojs/3679d71d-c02d-4fe4-b53f-31688a393bad%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.