Budibase/budibase · error

SSL certificate verification failed for ${url}. Consider set

Error message

SSL certificate verification failed for ${url}. Consider setting rejectUnauthorized to false if using self-signed certificates. Original error: ${error.message}

What it means

The REST integration catches fetch (undici) errors whose cause code indicates TLS certificate verification failure (UNABLE_TO_VERIFY_LEAF_SIGNATURE, CERT_UNTRUSTED, SELF_SIGNED_CERT_IN_CHAIN) and rethrows this descriptive error naming the URL, suggesting rejectUnauthorized: false for self-signed certificates, and including the original error message. It makes Node's low-level TLS failures actionable for datasource users.

Source

Thrown at packages/server/src/integrations/rest.ts:1004

          message?: string
        }
      }
      console.log("[rest integration] Fetch error details", {
        url,
        error: error.message,
        cause: error.cause?.message,
        code: error.cause?.code,
        hasDispatcher,
        usedProxyDispatcher,
        isHttpsUrl: url.startsWith("https://"),
        rejectUnauthorized,
      })
      if (
        error.cause?.code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" ||
        error.cause?.code === "CERT_UNTRUSTED" ||
        error.cause?.code === "SELF_SIGNED_CERT_IN_CHAIN"
      ) {
        throw new Error(
          `SSL certificate verification failed for ${url}. Consider setting rejectUnauthorized to false if using self-signed certificates. Original error: ${error.message}`
        )
      }

      if (error.cause?.code === "ECONNREFUSED" && usedProxyDispatcher) {
        throw new Error(
          `Connection refused when using proxy. Check proxy configuration and ensure the proxy server is accessible. Original error: ${error.message}`
        )
      }
      throw error
    }
    if (response.status === 401 && retry401) {
      const { authConfigId, authConfigType } = query
      if (authConfigType === RestAuthType.OAUTH2 && authConfigId) {
        await sdk.oauth2.cleanStoredTokensForAuthConfig(authConfigId)
        return await this._req(query, { ...opts, retry401: false })
      }
    }

View on GitHub (pinned to a81a902e9a)

Solutions

1. If self-signed/internal CA is acceptable for this datasource, set rejectUnauthorized: false in the REST datasource SSL config (or supply the proper CA cert instead where supported)
2. Install the server's full chain (leaf + intermediates) on the API server to fix incomplete chains
3. Add the internal CA certificate to the Node trust store (NODE_EXTRA_CA_CERTS=/path/to/ca.pem) for corporate proxies
4. Renew or reissue the certificate if expired or hostname-mismatched
5. Verify the failure with curl -v https://<url> to confirm it is a chain/trust issue rather than a network one

Example fix

// before (datasource config)
{ "url": "https://internal.example.com", "rejectUnauthorized": true }
// after (self-signed internal cert)
{ "url": "https://internal.example.com", "rejectUnauthorized": false }
// or, preferred: trust the internal CA
NODE_EXTRA_CA_CERTS=/etc/ssl/internal-ca.pem

// preflight TLS check before saving/running the query
import tls from "node:tls"
tls.connect({ host, port: 443, servername: host, rejectUnauthorized: true })
  .once("error", e => console.error("TLS check failed:", e.code))

function isSslVerificationError(err) {
  const codes = ["UNABLE_TO_VERIFY_LEAF_SIGNATURE","CERT_UNTRUSTED","SELF_SIGNED_CERT_IN_CHAIN"]
  return codes.includes(err?.cause?.code)
}

try {
  const result = await restQuery.execute()
} catch (e) {
  if (isSslVerificationError(e)) {
    // set rejectUnauthorized:false or add CA via NODE_EXTRA_CA_CERTS
  } else { throw e }
}

When it happens

Trigger: Executing a REST query against an https:// URL where the server presents a self-signed certificate, an untrusted/internal CA, an incomplete chain, or a hostname-mismatched leaf certificate; also common against internal services fronted by self-signed certs (e.g. local https dev servers, corporate intranet APIs).

Common situations: Internal company API behind a self-signed cert; missing intermediate certificate on the server (chain incomplete); corporate TLS-inspection proxy re-signing traffic with an internal CA not in Node's trust store; expired or hostname-mismatched certificates; Node runtime lacking updated CA bundle.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid custom REST template
• Plugin URL must use HTTPS.
• Failed to fetch import data - ${message}
• Custom REST templates can only be associated with REST datas
• Failed to parse response body: ${err}

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/38d2f7ddb9573816. Report an issue: GitHub.