Support for Self-signed Certificates

[beschoenen]

What feature would you like added?

I'm running my internal services solely over https, and would like to be able to configure orbital-sync to ignore self-signed certificate errors.

Version

No response

Log output

1/28/2023, 11:46:34 AM: ➡️ Signing in to http://pi-hole/admin...
1/28/2023, 11:46:34 AM: ✔️ Successfully signed in to http://pi-hole/admin!
1/28/2023, 11:46:34 AM: ➡️ Downloading backup from http://pi-hole/admin...
1/28/2023, 11:46:35 AM: ✔️ Backup from http://pi-hole/admin completed!
1/28/2023, 11:46:35 AM: ➡️ Signing in to https://pi-hole.nas.local/admin...
1/28/2023, 11:46:35 AM: ⚠ Failure: An unexpected error was thrown:
- FetchError: request to https://pi-hole.nas.local/admin/index.php?login failed, reason: self-signed certificate in certificate chain
1/28/2023, 11:46:35 AM: ⚠ Failure: 0/1 hosts synced.

[sambartik]

Hello, there is already a way to trust additional certs: https://nodejs.org/api/cli.html#node_extra_ca_certsfile

[joeavelar]

Hello, there is already a way to trust additional certs: https://nodejs.org/api/cli.html#node_extra_ca_certsfile

Hi @sambartik, I'm a noob so could you toss me a bone. ;) I added the following line to my docker compose file:

• SSL_CERT_FILE: './ssl-cert.pem'

but I'm still seeing this error in the logs.

6/24/2023, 8:55:02 PM: ➡️ Signing in to https://pi-hole.local.com/admin...
6/24/2023, 8:55:02 PM: ⚠ Failure: An unexpected error was thrown:

• FetchError: request to https://pi-hole.local.com/admin/index.php?login failed, reason: self-signed certificate in certificate chain

How should we be enabling this with a docker container? Thank you.

[ad3m3r5]

Hey @joeavelar, I just came across this same issue and here's how I fixed it using the above reference with Docker compose:

volumes:
  - /my/host/path/certificateName.crt:/usr/local/share/ca-certificates/certificateName.crt
environment:
  NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/certificateName.crt'

Obviously I'm using a CA certificate and the solution might be a little different if it's a single cert.

[badnetmask]

What I am going to say here is no way secure. It's just a workaround in case you need it.
I am using a self-signed certificate, which I could have workaround with the NODE_EXTRA_CA_CERTS variable, but it did not work because the cert is expired, so I found out about this:

NODE_TLS_REJECT_UNAUTHORIZED: 0

This completely ignores whatever is wrong with the certificates.
Use at your own risk. Not a legal advice. 😁

[beschoenen]

Thanks for all the info guys, I've since switched to running Let's Encrypt certificates inside my home network, so this issue is not needed for me anymore.