Error: unable to get issuer certificate from Nodejs

Help Security
1

Hello,

We are using npm mysql 2.17.1 to connect to memsql 6.8.7.

Sample nodejs code:

let poolSettings = {
      host: config.host,	      
      port: config.port,	   
      user: config.user,	     
      password: config.password,	      
      database: config.database,
      ssl: { ca: config.sslCert }
   };

this.pool = mysql.createPool(poolSettings);
this.pool.getConnection((err, connection) => { ... }

That is throwing the error:

Error: unable to get issuer certificate
    at TLSSocket.<anonymous> (../node_modules/mysql/lib/Connection.js:320:48)
    at emitNone (events.js:106:13)
    at TLSSocket.emit (events.js:208:7)
    at TLSSocket._finishInit (_tls_wrap.js:643:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38)
    --------------------
    at Protocol._enqueue (../node_modules/mysql/lib/protocol/Protocol.js:144:48)
    at Protocol.handshake (../node_modules/mysql/lib/protocol/Protocol.js:51:23)
    at PoolConnection.connect (../node_modules/mysql/lib/Connection.js:119:18)
    at Pool.getConnection (../node_modules/mysql/lib/Pool.js:48:16)
    ...

But the same cert works with multiple other clients including grafana & mysql cli.
Sample mysql cli command:

mysql --ssl-ca=config/memsql-ca.crt -h <host> -u <user> -D <database-name> -p

Is anyone aware of this issue? If so, any pointers would be greatly appreciated.
Or does this not belong in this forum?

Thanks.

2

Hello geet,

As part of the node.js implementation, the client has specific requirements requiring the full certificate chain.

For MemSQL Helios customers, the path forward is to raise a support ticket with the MemSQL Support team and we will work towards providing you with all the necessary information.

Kind regards,
Cindy

1 Like
3

By default, Node doesn’t pull in the machine’s custom certificates. You can look to node.js - How to add custom certificate authority (CA) to nodejs - Stack Overflow and other sites to see how to load custom CAs into Node. That’ll help load the full trust chain.

1 Like