badges/shields · error · InvalidParameter

strict ssl is required

Error message

strict ssl is required

What it means

This error is thrown by AuthHelper's enforceStrictSsl when the service requires strict SSL (`_requireStrictSsl` is true) and the outgoing request options indicate an insecure SSL connection (e.g. http:// protocol or `rejectUnauthorized: false`), detected via the static `_isInsecureSslRequest({ options })` check. It is raised from `_withAnyAuth`, the shared entry point for all auth-merging helpers (withBasicAuth, withApiKeyHeader, withBearerAuthHeader, withQueryStringAuth, withJwtAuth), before any credentials are attached. Shields.sh refuses to send credentials over a connection it considers insecure when the service declares strict SSL.

Source

Thrown at core/base-service/auth-helper.js:94

    if (this.isRequired) {
      return this.isConfigured
    } else {
      const configIsEmpty = !this._user && !this._pass
      return this.isConfigured || configIsEmpty
    }
  }

  static _isInsecureSslRequest({ options = {} }) {
    const strictSSL = options?.https?.rejectUnauthorized ?? true
    return strictSSL !== true
  }

  enforceStrictSsl({ options = {} }) {
    if (
      this._requireStrictSsl &&
      this.constructor._isInsecureSslRequest({ options })
    ) {
      throw new InvalidParameter({ prettyMessage: 'strict ssl is required' })
    }
  }

  isAllowedOrigin(url) {
    let parsed
    try {
      parsed = new URL(url)
    } catch (e) {
      throw new InvalidParameter({ prettyMessage: 'invalid url parameter' })
    }

    const { protocol, host } = parsed
    const origin = `${protocol}//${host}`
    return this._authorizedOrigins.includes(origin)
  }

  shouldAuthenticateRequest({ url, options = {} }) {
    const originViolation = !this.isAllowedOrigin(url)

View on GitHub (pinned to 766fd8bc89)

Solutions

1. Switch the request/target URL from http:// to https:// so `_isInsecureSslRequest` returns false
2. Remove any `rejectUnauthorized: false` (or equivalent insecure TLS option) from the request options
3. If the endpoint genuinely cannot do TLS, fix the certificate/server side rather than disabling strict SSL
4. Only if explicitly intended for a trusted internal network, set the service's `requireStrictSsl`/`_requireStrictSsl` to false in the service subclass

Example fix

// before
const { buffer } = await fetchWithBasicAuth({ url: 'http://self-hosted.internal/api', options: { https: { rejectUnauthorized: false } } })
// after
const { buffer } = await fetchWithBasicAuth({ url: 'https://self-hosted.internal/api' })

function assertSecureRequest(url, options = {}) {
  const u = new URL(url)
  const tlsDisabled = options.https?.rejectUnauthorized === false
  if (u.protocol !== 'https:' || tlsDisabled) {
    throw new Error(`strict ssl is required: ${u.protocol} request or TLS verification disabled`)
  }
}
// call before any withBasicAuth/withJwtAuth etc.
assertSecureRequest(targetUrl, requestOptions)

function isInsecureSslRequest({ options = {}, url }) {
  try { return new URL(url).protocol !== 'https:' || options.https?.rejectUnauthorized === false } catch { return true }
}
if (!isInsecureSslRequest({ url, options })) { /* safe to authenticate */ }

try {
  const params = service.withBasicAuth(requestParams)
} catch (err) {
  if (err.prettyMessage === 'strict ssl is required') {
    // upgrade URL to https or remove rejectUnauthorized:false, then retry
  } else throw err
}

When it happens

Trigger: Calling any auth wrapper (withBasicAuth/withApiKeyHeader/withBearerAuthHeader/withQueryStringAuth/withJwtAuth) with request params whose URL uses http:// instead of https://, or with got options disabling TLS verification (`https: { rejectUnauthorized: false }`), while the service class sets `requireStrictSsl = true` (or `_requireStrictSsl` resolves true).

Common situations: Self-hosted instance configs pointing at an internal http:// endpoint; developers disabling cert validation to work around self-signed certificates; misconfigured service subclasses that default to http; test/staging URLs pasted into config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• requested origin not authorized
• invalid url parameter
• please use https
• domain is blocked
• invalid response data from auth endpoint

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/022ed23bcd02a63f. Report an issue: GitHub.