{"record":{"id":"2f6df93c2c3ceb18","repo":"n8n-io/n8n","slug":"ssl-issue-consider-using-the-ignore-ssl-issues","errorCode":null,"errorMessage":"SSL Issue: consider using the 'Ignore SSL issues' option","messagePattern":"SSL Issue: consider using the 'Ignore SSL issues' option","errorType":"exception","errorClass":"NodeSslError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/backend-network/src/http/legacy-request.ts","lineNumber":149,"sourceCode":"\t\t\t\t}\n\n\t\t\t\terror.message = `${response.status as number} - ${JSON.stringify(responseData)}`;\n\t\t\t\tthrow Object.assign(error, {\n\t\t\t\t\tstatusCode: response.status,\n\t\t\t\t\t/**\n\t\t\t\t\t * Axios adds `status` when serializing, causing `status` to be available only to the client.\n\t\t\t\t\t * Hence we add it explicitly to allow the backend to use it when resolving expressions.\n\t\t\t\t\t */\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t\terror: responseData,\n\t\t\t\t\tresponse: {\n\t\t\t\t\t\theaders: response.headers,\n\t\t\t\t\t\tstatus: response.status,\n\t\t\t\t\t\tstatusText: response.statusText,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t} else if ('rejectUnauthorized' in requestObject && error.code?.includes('CERT')) {\n\t\t\t\tthrow new NodeSslError(error);\n\t\t\t}\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n","sourceCodeStart":131,"sourceCodeEnd":156,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/backend-network/src/http/legacy-request.ts#L131-L156","documentation":"NodeSslError thrown in the legacy request error handler when the request was made with rejectUnauthorized set and the underlying error.code includes 'CERT'. NodeSslError (from n8n-workflow) carries the fixed user-facing message 'SSL Issue: consider using the 'Ignore SSL issues' option'. It signals a TLS certificate validation failure on the node's outbound HTTP request.","triggerScenarios":"A node HTTP request fails with an error whose code contains 'CERT' (e.g. UNABLE_TO_VERIFY_LEAF_SIGNATURE, CERT_HAS_EXPIRED, SELF_SIGNED_CERT_IN_CHAIN) and requestObject.rejectUnauthorized was set. The branch at line 148 converts it to NodeSslError so the UI can prompt the user to enable 'Ignore SSL issues'.","commonSituations":"Target server uses a self-signed or internal-CA certificate; a corporate proxy performs TLS interception with an untrusted CA; an expired certificate on the target; a development endpoint without a valid cert; clock skew making a valid cert appear expired.","solutions":["Enable the node's 'Ignore SSL Issues' option (or set rejectUnauthorized:false where appropriate).","Import the signing CA into the host trust store (NODE_EXTRA_CA_CERTS) for a permanent fix.","Renew the expired certificate on the target server.","Fix host clock skew if the cert appears expired due to time drift."],"exampleFix":"// before\nconst res = await this.helpers.httpRequest({ url, json: true });\n\n// after - accept the self-signed cert for this node\nconst res = await this.helpers.httpRequest({\n  url,\n  json: true,\n  skipSslVerification: true,\n});","handlingStrategy":"try-catch","validationCode":"// Pre-validate the URL scheme/host before sending, and decide skipSsl policy\nconst isInternalCa = (host: string) => /\\.corp\\.|\\.internal$/.test(host);\nconst skipSsl = isInternalCa(new URL(url).host);","typeGuard":"import { NodeSslError } from 'n8n-workflow';\nconst isNodeSslError = (e: unknown): boolean => e instanceof NodeSslError;","tryCatchPattern":"try {\n  await this.helpers.httpRequest({ url, json: true });\n} catch (e) {\n  if (e instanceof NodeSslError) {\n    // prompt user to enable 'Ignore SSL issues' or install the CA\n    await this.helpers.httpRequest({ url, json: true, skipSslVerification: true });\n  } else {\n    throw e;\n  }\n}","preventionTips":["Import internal CAs via NODE_EXTRA_CA_CERTS instead of disabling verification.","Renew expiring certificates before they break node executions.","Use skipSslVerification only for trusted internal endpoints, never for public ones."],"tags":["ssl","tls","certificate","http","nodes","backend-network"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}