Node-fetch: Doesn't download intermediate certificates

[Janpot]

See https://github.com/nodejs/node/issues/16336

According to https://github.com/nodejs/node/issues/16336#issuecomment-338434788 intermediate certificate downloading is supposed to be implemented by clients, like browsers and node-fetch.

await fetch('https://incomplete-chain.badssl.com/');

throws an error, even though the page opens without errors in chrome.

[bitinn]

Thx for the report, it's likely we won't be working around a server config issue, so my suggestion:

• There are best practice on how to serve intermediate certificate properly, if a server is not following best practice, the best approach would be to ask them to update it.

• There are alternatives where you can cache this cert yourself and supply them through Agent option, see this Request issue for workarounds: https://github.com/request/request/issues/3106

• In a crawler scenario, I agree there isn't an easy solution, you will have to build around node-fetch to prefetch certificate in order to accommodate this issue.

[rl-saen]

There are best practice on how to serve intermediate certificate properly, if a server is not following best practice, the best approach would be to ask them to update it.

Can you point me towards resources for this? Running into this exact issue at the moment with a service that I set up myself but can't find a starting point at the moment beyond You messed up your certs.

[xxczaki]

@rl-saen Here are some resources, that might come in handy:

• https://www.ssl.com/guide/ssl-best-practices/#configure
• https://www.entrust.com/lp/wp-content/uploads/sites/2/2016/07/Entrust-eGuide-SSL-Best-Practices-V2-WEB.pdf (pages 11-13)
• http://nginx.org/en/docs/http/configuring_https_servers.html#chains
• https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html

[Janpot]

@xxczaki node-fetch may be used in scenarios where you're not in control of the server. Which is my use-case and the reason to open this ticket.