{"record":{"id":"38d2f7ddb9573816","repo":"Budibase/budibase","slug":"ssl-certificate-verification-failed-for-url-co","errorCode":null,"errorMessage":"SSL certificate verification failed for ${url}. Consider setting rejectUnauthorized to false if using self-signed certificates. Original error: ${error.message}","messagePattern":"SSL certificate verification failed for (.+?)\\. Consider setting rejectUnauthorized to false if using self-signed certificates\\. Original error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/integrations/rest.ts","lineNumber":1004,"sourceCode":"          message?: string\n        }\n      }\n      console.log(\"[rest integration] Fetch error details\", {\n        url,\n        error: error.message,\n        cause: error.cause?.message,\n        code: error.cause?.code,\n        hasDispatcher,\n        usedProxyDispatcher,\n        isHttpsUrl: url.startsWith(\"https://\"),\n        rejectUnauthorized,\n      })\n      if (\n        error.cause?.code === \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\" ||\n        error.cause?.code === \"CERT_UNTRUSTED\" ||\n        error.cause?.code === \"SELF_SIGNED_CERT_IN_CHAIN\"\n      ) {\n        throw new Error(\n          `SSL certificate verification failed for ${url}. Consider setting rejectUnauthorized to false if using self-signed certificates. Original error: ${error.message}`\n        )\n      }\n\n      if (error.cause?.code === \"ECONNREFUSED\" && usedProxyDispatcher) {\n        throw new Error(\n          `Connection refused when using proxy. Check proxy configuration and ensure the proxy server is accessible. Original error: ${error.message}`\n        )\n      }\n      throw error\n    }\n    if (response.status === 401 && retry401) {\n      const { authConfigId, authConfigType } = query\n      if (authConfigType === RestAuthType.OAUTH2 && authConfigId) {\n        await sdk.oauth2.cleanStoredTokensForAuthConfig(authConfigId)\n        return await this._req(query, { ...opts, retry401: false })\n      }\n    }","sourceCodeStart":986,"sourceCodeEnd":1022,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/integrations/rest.ts#L986-L1022","documentation":"The REST integration catches fetch (undici) errors whose cause code indicates TLS certificate verification failure (UNABLE_TO_VERIFY_LEAF_SIGNATURE, CERT_UNTRUSTED, SELF_SIGNED_CERT_IN_CHAIN) and rethrows this descriptive error naming the URL, suggesting rejectUnauthorized: false for self-signed certificates, and including the original error message. It makes Node's low-level TLS failures actionable for datasource users.","triggerScenarios":"Executing a REST query against an https:// URL where the server presents a self-signed certificate, an untrusted/internal CA, an incomplete chain, or a hostname-mismatched leaf certificate; also common against internal services fronted by self-signed certs (e.g. local https dev servers, corporate intranet APIs).","commonSituations":"Internal company API behind a self-signed cert; missing intermediate certificate on the server (chain incomplete); corporate TLS-inspection proxy re-signing traffic with an internal CA not in Node's trust store; expired or hostname-mismatched certificates; Node runtime lacking updated CA bundle.","solutions":["If self-signed/internal CA is acceptable for this datasource, set rejectUnauthorized: false in the REST datasource SSL config (or supply the proper CA cert instead where supported)","Install the server's full chain (leaf + intermediates) on the API server to fix incomplete chains","Add the internal CA certificate to the Node trust store (NODE_EXTRA_CA_CERTS=/path/to/ca.pem) for corporate proxies","Renew or reissue the certificate if expired or hostname-mismatched","Verify the failure with curl -v https://<url> to confirm it is a chain/trust issue rather than a network one"],"exampleFix":"// before (datasource config)\n{ \"url\": \"https://internal.example.com\", \"rejectUnauthorized\": true }\n// after (self-signed internal cert)\n{ \"url\": \"https://internal.example.com\", \"rejectUnauthorized\": false }\n// or, preferred: trust the internal CA\nNODE_EXTRA_CA_CERTS=/etc/ssl/internal-ca.pem","handlingStrategy":"try-catch","validationCode":"// preflight TLS check before saving/running the query\nimport tls from \"node:tls\"\ntls.connect({ host, port: 443, servername: host, rejectUnauthorized: true })\n  .once(\"error\", e => console.error(\"TLS check failed:\", e.code))","typeGuard":"function isSslVerificationError(err) {\n  const codes = [\"UNABLE_TO_VERIFY_LEAF_SIGNATURE\",\"CERT_UNTRUSTED\",\"SELF_SIGNED_CERT_IN_CHAIN\"]\n  return codes.includes(err?.cause?.code)\n}","tryCatchPattern":"try {\n  const result = await restQuery.execute()\n} catch (e) {\n  if (isSslVerificationError(e)) {\n    // set rejectUnauthorized:false or add CA via NODE_EXTRA_CA_CERTS\n  } else { throw e }\n}","preventionTips":["Properly chain certificates on servers (include intermediates)","Use NODE_EXTRA_CA_CERTS for internal/corporate CAs instead of disabling verification wholesale","Set up cert renewal/monitoring to avoid expired certificates","Prefer supplying a CA certificate over rejectUnauthorized:false when the datasource config supports it"],"tags":["ssl","tls","certificate","https","rest"],"backgroundTag":"ssl-certificate-verification-failed","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}