Axios fails with 'certificate has expired' when certificate has not expired

user_136785 0
Viewed 2072

I'm using Axios to post to a remote API. Although it has worked great for several years, the requests have suddenly started throwing an error "certificate has expired' - despite the fact that the certificate has not expired. The API's domain has a working Let's Encrypt cert which isn't up for its next auto-renewal for another 2 months. In addition, if I run the exact same code on a different OS, it works (I'm on Linux; if I reboot the same dual-boot machine to Windows, the same node script successfully completes all of its Axios calls).

Why might Axios have suddenly started reporting an expired certificate, when the certificate is not expired?

(Note: I'm aware that I can force Axios not to check the cert at all, but that is not the desired solution - I'd like to understand why it's failing and rectify it).

axios
2 Answers

The DST root formerly used and by default still bridged by LetsEncrypt just expired.

(note edits 10/05)

nodejs should successfully connect to a server using a LetsEncrypt cert with the 'compatibility' chain (i.e. still using the bridge to DST, even though it's expired, for old Android) IF

  1. it has the ISRG root cert in its truststore aka root list. By default nodejs uses a compiled-in root list and v8.0.0 up contains the ISRG root. However application code like axios can replace or extend the compiled-in list, in which case it's the version/contents used by the application that matter.

  2. AND nodejs uses OpenSSL 1.1.0 up (my previous belief that 1.1.1 was needed proved wrong on more thorough testing) OR the DST root is removed from the truststore (you can't remove it from the compiled-in list, but if you use a replacement list, you can omit/remove it from that).

    On Linux, at least a Linux distro with a package manager, nodejs is probably built to use the system-supplied OpenSSL; check what the package manager shows for dependencies, or whether ldd $(which node) lists some version of libssl and libcrypto (noting that different systems/packagers sometimes use version numbers for these library files that are related to, but NOT the same as, the OpenSSL version they contain!).

    On Windows, OpenSSL is usually not installed, and when it is, not necessarily in a fixed place, so nodejs is normally built to use its own (static-linked) OpenSSL. In this case the version of nodejs must be new enough, and I don't know what the mapping is, but it appears yours is sufficient.

user_28688010

Problem for me was I was using an old Node version by accident, switching to the latest released version fixed the issue.

user_74471800
Related