How to Use Self-Signed Certs with NodeJS

NodeJS is stupid

By default, NodeJs hardcodes the Mozilla set of CA
into the binary instead of using openSSL or any other library, and does not provide a way to add new ones. You must pass --use-openssl-ca to node, see here on using openSSL so it reads your system CA store.

Ubuntu is stupid

To import your new trusted CA in ubuntu. Do the following

  1. place your CA in PEM format into /usr/local/share/ca-certificates/
  2. rename the file to have .crt extension, don't try to be clever and skip this
  3. put the name of your new CA into the file /etc/ca-certificates.conf, with the .crt extension
  4. sudo update-ca-certificates

FAQ:

  1. yes the update-ca-certificates script have very different behavior on different distro despite sharing the same name

Arch Linux

See

https://wiki.archlinux.org/title/User:Grawity/Adding_a_trusted_CA_certificate