Angular SSR requests failing for secured ABP OpenIddict APIs (works in browser and Postman) #10588

2 Answer(s)

• 

  0

  AI-Bot created 5 months ago

  Support Team ABP Agent

  • UNABLE_TO_VERIFY_LEAF_SIGNATURE is not an ABP/OpenIddict authentication failure. It’s a Node.js TLS trust-chain validation error during SSR when Node calls your ABP backend over HTTPS and cannot validate the server certificate chain (very common with missing intermediate certs, corporate TLS interception, or self-signed/internal CA certs).
    That’s why it can “work in browser/Postman” (they often use OS trust store / may have different trust behavior) but fail in SSR (Node uses its own CA bundle).

  • Fix it on the certificate / chain side (recommended):

    1. Ensure your API/AuthServer HTTPS endpoint presents the full certificate chain (server cert + intermediates).
       • If you’re using Nginx/Apache/IIS/reverse-proxy, configure it to serve the full chain (often called fullchain.pem on Let’s Encrypt setups).
    2. If you have an internal CA, add that CA to the machine trust and/or supply it to Node (next bullet).

  • Fix it on the SSR Node runtime side (when you must trust a private CA):

    1. Export the issuing CA (or corporate proxy CA) as a PEM file, e.g. corp-root-ca.pem.
    2. Start SSR with:
       • NODE_EXTRA_CA_CERTS=/path/to/corp-root-ca.pem
       • (Optional for debugging only) NODE_DEBUG=tls This makes Node trust that CA and resolves UNABLE_TO_VERIFY_LEAF_SIGNATURE without disabling TLS checks.

  • Avoid this “quick fix” in production (insecure):

    • Setting NODE_TLS_REJECT_UNAUTHORIZED=0 or using an HTTPS agent with rejectUnauthorized: false will bypass TLS verification entirely. It may “make it work”, but it weakens security and should not be used beyond local debugging.

  • After TLS is fixed, if the API is actually secured and SSR must call it authenticated:

    • SSR must forward the same auth context (cookies / bearer token) from the incoming browser request to your ABP backend when rendering. This is an Angular SSR integration concern; ABP will only accept what the request contains.

  Links (verified):

  • https://abp.io/docs/latest/modules/openiddict
  • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment
  • https://abp.io/community/articles/0znavo8r

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  The error UNABLE_TO_VERIFY_LEAF_SIGNATURE is a Node.js SSL/TLS certificate chain verification error. This is not related to ABP or OpenIddict authentication — it means Node.js cannot verify the SSL certificate of your backend server during SSR requests.

  To help confirm the root cause, could you provide some details:

  1. Is your ABP backend running on HTTPS? If so, are you using a self-signed certificate or a certificate from a trusted CA?
  2. Are you running this in a development environment or production?
  3. Could you share the backend URL (or just the domain/host) so we can check the certificate chain?
  4. Does setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED=0 before starting your SSR server make the error go away? (This is only for testing, not a production solution.)

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel