无法验证第一个证书 - Nodejs TLS

Question

I'm using the node-module basic-ftp to try to establish a secure connection via TLS/ SSL . The server uses a wildcard CA-signed certificate as it's hostname. I can't seem to find an answer for the followig error code.

Connected to 1.1.1.1:21
< 220 Welcome to ftp.foo.com  
> AUTH TLS 
< 234 Using authentication type TLS
{ Error: unable to verify the first certificate
   at TLSSocket.onConnectSecure (_tls_wrap.js:1051:34)
   at TLSSocket.emit (events.js:189:13)
   at TLSSocket._finishInit (_tls_wrap.js:633:8) code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' 
}

Below you find the sample code:

const ftp = require("basic-ftp");

async establishFtpsConnection() {
    const client = new ftp.Client();
    client.ftp.verbose = true;

    try {
        await client.access({
            host: "ftp.foo.com",
            user: "bar",
            password: "1234",
            port: 21,
            secure: true
        });

        const list = await client.list();
        console.log(list);
    } catch (err) {
        console.log(err);
    }

    client.close();
}

NOTE: I'm trying to get it to work for my production environment. So disabling or rejecting unauthorization is NO option for me.

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';

OR

rejectUnauthorized: false

Answer 1

Try this :

const ftp = require("basic-ftp");

async establishFtpsConnection() {
    const client = new ftp.Client();
    client.ftp.verbose = true;
    const tlsOptions = {
            cert: fs.readFileSync('fullchain.pem', 'ascii')
             // a PEM containing the SERVER and ALL INTERMEDIATES
           }


    try {
        await client.access({
            host: "ftp.foo.com",
            user: "bar",
            password: "1234",
            port: 21,
            secure: true,
           secureOptions:tlsOptions
        });

        const list = await client.list();
        console.log(list);
    } catch (err) {
        console.log(err);
    }

    client.close();
}

If you are still getting an error then try to inject root SSL certificates

var sslRootCAs = require('ssl-root-cas/latest')
sslRootCAs.inject()