bug: extraCACerts doesn't work #5028

Activity

1. isshaddad commented on Oct 14, 2026

   

   isshaddad

   on Oct 14, 2026

   Collaborator

   More actions

   Thanks for the report, you're right. deploy never passes extraCACerts to the image build, so NODE_EXTRA_CA_CERTS ends up as an empty string in the image, and the cert file isn't copied in either. Setting NODE_EXTRA_CA_CERTS in the dashboard won't help, because the empty value from the image wins. We'll get it fixed.

   Until the fix ships, this should work around it by loading the CA in code. Add the PEM contents as an environment variable (e.g. EXTRA_CA_CERT) in the dashboard, then create init.ts at the root of your trigger directory, which runs before your tasks:

   // trigger/init.ts (default `node` runtime, Node 24)
   import tls from "node:tls";
   
   const extraCa = process.env.EXTRA_CA_CERT;
   if (extraCa && typeof tls.setDefaultCACertificates === "function") {
     tls.setDefaultCACertificates([...tls.getCACertificates("default"), extraCa]);
   }

   This covers both fetch and node:https (and clients built on them). Note that if init.ts throws, your runs will fail to start, so keep the guard in.

   If you're on the node-22 runtime, tls.setDefaultCACertificates isn't available, so set the agents directly instead (this needs undici as a dependency):

   // trigger/init.ts (node-22 runtime)
   import https from "node:https";
   import tls from "node:tls";
   import { Agent, setGlobalDispatcher } from "undici";
   
   const extraCa = process.env.EXTRA_CA_CERT;
   if (extraCa) {
     const ca = [...tls.rootCertificates, extraCa];
     https.globalAgent.options.ca = ca;
     setGlobalDispatcher(new Agent({ connect: { ca } }));
   }

   If your HTTP client creates its own agent with an explicit ca option, pass the cert there too. Let us know if this doesn't work for you.