Skip to content

Conversation

@magurotuna
Copy link
Contributor

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval "const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"
03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA
03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCA
error: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuer
const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();
          ^
    at async mainFetch (ext:deno_fetch/26_fetch.js:192:12)
    at async fetch (ext:deno_fetch/26_fetch.js:475:11)
    at async file:///test/$deno$eval.mts:1:11

    hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval "const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"
200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder

WORKDIR /build
COPY . .
RUN cargo build --profile fast

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y \
    curl \
    ca-certificates \
    nftables \
    iproute2 \
    procps \
    unzip \
    && rm -rf /var/lib/apt/lists/*

# Install Node.js 24
RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
    && apt-get install -y nodejs

# Install Deno
RUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh

# Copy httpjail binary
COPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail

WORKDIR /
CMD ["/bin/bash"]

Closes #96

Deno uses DENO_CERT instead of standard SSL_CERT_FILE to specify
custom CA certificates. Without this, Deno programs fail with
certificate errors when running under httpjail.
@ammario ammario enabled auto-merge (squash) December 24, 2025 19:09
@ammario ammario disabled auto-merge December 24, 2025 19:28
@ammario ammario merged commit 9fddbed into coder:main Dec 24, 2025
5 of 6 checks passed
@magurotuna magurotuna deleted the add-deno-cert branch December 25, 2025 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add DENO_CERT environment variable for Deno TLS support

2 participants