nodejs/undici

Unprecise error message on fetch() to an endpoint with a certificate which was signed by an "unkown" CA

Open

#2199 opened on Jul 28, 2023

View on GitHub
 (5 comments) (0 reactions) (0 assignees)JavaScript (5,319 stars) (444 forks)batch import
enhancementgood first issue

Description

Bug Description

There is a unprecise error message ("fetch failed") on fetch() to an endpoint with a certificate which was signed by an "unkown" CA. If its an custom or internal CA, the fetch() will fail, that seems correct, but the error message ist absolut unprecise. It is therefore very difficult to find the cause.

Reproducible By

fetch() to an enpoint with a certificate which was signed by an "unkown" CA.

An "unkown" CA seems to be an CA which not exist in the default search path for CAs of node. By default node seem to use CA-certificates baked in the build.

Expected Behavior

A useful error message is shown.

Logs & Screenshots

TypeError: fetch failed at Object.fetch (node:internal/deps/undici/undici:11576:11) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) ...

Environment

Ubuntu 22.04 Node v18.17.0

Contributor guide

Tech stack
javascriptnodejs
Domain
backenddeveloper experience
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
needs investigation
Prerequisites
basic knowledge of Node.jsfamiliarity with undici HTTP client
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
Locate the source of the 'fetch failed' error message in undici's fetch implementation (likely in lib/fetch or node:internal/deps/undici/undici). Investigate how certificate errors are caught and currently emit generic messages. The fix should propagate the underlying TLS/certificate error to provide a clear error message indicating the CA issue.