fix(dev): recommend a CA root instead of disabling TLS verification

Author: danielroe

packages/nuxt-cli/src/dev/cert.ts

@@ -3,7 +3,7 @@ import type { Buffer } from 'node:buffer'
 import{execFileSync}from'node:child_process'
 import{createHash,createPrivateKey,X509Certificate}from'node:crypto'
 import{existsSync,readFileSync}from'node:fs'
-import{readFile}from'node:fs/promises'
+import{readFile,writeFile}from'node:fs/promises'
 import{isIP}from'node:net'
 importprocessfrom'node:process'
 
@@ -31,6 +31,12 @@ export interface ResolvedCertificate {
 /** Path the `pfx` buffer was read from, for reporting back to `devServer.https`. */
 pfxPath?: string
 passphrase?: string
+/**
+ * Directory holding the local certificate authority `mkcert` issued the
+ * certificate from. Node does not read the system trust store, so a client
+ * running under Node needs this root passed explicitly.
+ */
+caRoot?: string
 }
 
 exportasyncfunctionresolveCertificate(options: HTTPSOptions): Promise<ResolvedCertificate>{
@@ -57,17 +63,20 @@ async function generateCertificate(options: HTTPSOptions): Promise<ResolvedCerti
 constcertPath=join(dir,'cert.pem')
 constkeyPath=join(dir,'key.pem')
 
+constcaRootPath=join(dir,'caroot')
+
 if(!isCertificateUsable(certPath,keyPath,domains)){
-constgenerated=awaitgenerateWithMkcert(certPath,keyPath,domains)
-||generateWithOpenssl(certPath,keyPath,domains,options.validityDays)
-if(!generated){
+constcaRoot=awaitgenerateWithMkcert(certPath,keyPath,domains)
+if(caRoot===undefined&&!generateWithOpenssl(certPath,keyPath,domains,options.validityDays)){
 thrownewActionableError('Could not generate a development certificate. Install `mkcert` (https://github.com/FiloSottile/mkcert) or provide `--https.cert` and `--https.key`.')
 }
+awaitwriteFile(caRootPath,caRoot??'','utf8').catch(error=>debug('Could not record the certificate authority root:',error))
 }
 
 return{
 cert: awaitreadFile(certPath,'utf8'),
 key: awaitreadFile(keyPath,'utf8'),
+caRoot: awaitreadFile(caRootPath,'utf8').then(value=>value.trim()||undefined).catch(()=>undefined),
 }
 }
 
@@ -96,19 +105,20 @@ function isCertificateUsable(certPath: string, keyPath: string, domains: string[
 }
 }
 
-asyncfunctiongenerateWithMkcert(certPath: string,keyPath: string,domains: string[]): Promise<boolean>{
+/** The certificate authority root `mkcert` issued from, or `undefined` if it could not be used. */
+asyncfunctiongenerateWithMkcert(certPath: string,keyPath: string,domains: string[]): Promise<string|undefined>{
 constbinary=awaitresolveMkcert()
 if(!binary){
-returnfalse
+returnundefined
 }
 try{
 execFileSync(binary,['-install'],{stdio: ['inherit','ignore','inherit']})
 execFileSync(binary,['-cert-file',certPath,'-key-file',keyPath, ...domains],{stdio: 'ignore'})
-returntrue
+returnexecFileSync(binary,['-CAROOT'],{encoding: 'utf8'}).trim()||''
 }
 catch(error){
 debug('Failed to generate certificate with mkcert:',error)
-returnfalse
+returnundefined
 }
 }
 

packages/nuxt-cli/src/dev/utils.ts

@@ -28,7 +28,7 @@ import { ActionableError } from '../utils/errors'
 import{clearBuildDir}from'../utils/fs'
 import{loadKit}from'../utils/kit'
 import{acquireLock,formatLockError,getTakeoverPid,updateLock}from'../utils/lockfile'
-import{debug,writeNotice}from'../utils/logger'
+import{debug,logger,writeNotice}from'../utils/logger'
 import{loadNuxtManifest,resolveNuxtManifest,writeNuxtManifest}from'../utils/nuxt'
 import{renderError,renderErrorAnsi}from'./error-lazy'
 import{listen}from'./listen'
@@ -682,8 +682,11 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
 this.#currentNuxt.options.devServer.url=getAddressURL(addr,!!this.listener.https)
 this.#currentNuxt.options.devServer.https=resolveDevServerHTTPS(this.listener.https)
 
-if(this.listener.https&&!process.env.NODE_TLS_REJECT_UNAUTHORIZED){
-console.warn('You might need `NODE_TLS_REJECT_UNAUTHORIZED=0` environment variable to make https work.')
+if(this.listener.https&&process.env.NODE_TLS_REJECT_UNAUTHORIZED!=='0'&&!process.env.NODE_EXTRA_CA_CERTS){
+constcaRoot=this.listener.https.caRoot
+logger.warn(caRoot
+ ? `Node does not read your system trust store, so requests to this server from Node will not trust its certificate.\n Set \`NODE_EXTRA_CA_CERTS=${join(caRoot,'rootCA.pem')}\` to fix that.`
+ : 'Node does not read your system trust store, so requests to this server from Node will not trust its certificate.\n Set `NODE_EXTRA_CA_CERTS` to the certificate authority that issued it, or install `mkcert` for a locally-trusted certificate.')
 }
 
 constkit=awaitloadKit(this.options.cwd)