Skip to content

Turbopack rustls-tls fails to recognize system keychain certs #79059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aberoham opened this issue May 11, 2025 · 0 comments · May be fixed by aberoham/next.js#1 or #79060
Open

Turbopack rustls-tls fails to recognize system keychain certs #79059

aberoham opened this issue May 11, 2025 · 0 comments · May be fixed by aberoham/next.js#1 or #79060
Labels
Turbopack Related to Turbopack with Next.js.

Comments

@aberoham
Copy link

aberoham commented May 11, 2025

Link to the code that reproduces this issue

https://github.com/aberoham/repro-custom-ca

To Reproduce

  1. Start a nextjs app in dev mode with Turbopack running on a OS flavour that uses Rustls (rather than native-tls)
  2. If a web proxy or man-in-the-middle uses a custom certificate authority -- as is common with Enterprise gateway proxies such as Zscaler, Netskope, Cloudflare Warp or worse -- turbopack build fetch of remote HTTPs-hosted assets fails
  3. Change turbo-tasks-fetch to use "rustls-tls-native-roots"
  4. https fetch now works, no cert errors

Current vs. Expected behavior

Sub-page assets should be able to be fetched by turbo-tasks-fetch even if using a non-standard certificate authority in the layer7 TLS connection.

The rustls-tls-native-roots feature enables reqwest (via rustls) to load CAs from the OS native certificate store, thus trusting your custom CA.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.4.0: Fri Apr 11 18:33:39 PDT 2025; root:xnu-11417.101.15~117/RELEASE_ARM64_T6020
  Available memory (MB): 16384
  Available CPU cores: 10
Binaries:
  Node: 22.15.0
  npm: 10.9.2
  Yarn: N/A
  pnpm: 10.6.5
Relevant Packages:
  next: 15.3.0 // There is a newer version (15.3.2) available, upgrade recommended!
  eslint-config-next: 15.3.0
  react: 19.1.0
  react-dom: 19.1.0
  typescript: 5.8.3

Which area(s) are affected? (Select all that apply)

Turbopack

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Turbopack Related to Turbopack with Next.js.
Projects
None yet
1 participant