workers-sdk: 🐛 BUG: Wrangler dev fails to fetch()

For the error failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate I found that you can export SSL_CERT_FILE to get around this problem. In my case I run export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt.

I use NixOS, and have created a reproduction at scottwillmoore/cloudflare-workers-with-nix.

EDIT: My reproduction uses wrangler@3.3.0.

@mrbbot appreciate the update, unfortunately even the latest miniflare (3.0.2) doesn’t seem to solve the issue either.

└─┬ wrangler@3.1.1
  └── miniflare@3.0.2

Same here, unable to use plain “wrangler dev” after uprading to 3.0.0. Using Windows 11.

My app also uses fetch() to external APIs.

Using “wrangler dev --remote” appears to work with 3.0.0.

workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:215: failed: TLS peer's certificate is not trusted; reason = self signed certificate in certificate chain                      
stack: 7ff769b98a6f 7ff769bdc9dd 0 0 0 0 0 0 0 0 0 0; sentryErrorContext = jsgInternalError  

Hey everyone! 👋 This should be fixed with miniflare@3.0.1. wrangler’s version constraint for miniflare is ^3.0.0, so you should be able to run npm update miniflare to get the latest version and fix the issue now. We’ll release a version of Wrangler with miniflare@3.0.1 set as the minimum version soon. 👍

im using cloudlflare queues, and --remote does not support queues yet 😦 ==> https://github.com/cloudflare/workerd/issues/855

catch22 ==> im dead in the water here… please help

Hey! 👋 Thanks for raising this. I think this issue only affects secure https: fetch()es on Windows. Will try get this fixed. 👍 For now, you may want to use wrangler dev --remote which runs your Worker on the Cloudflare network, or stay on Wrangler 2 and use wrangler dev --local for local development.

if its any clue - it seems exacerbated when I attempt to run workers in the background

Reading between the lines of the linked PR cloudflare/workers-sdk#3352, I was able to work around this by adding the following to my package.json:

  "resolutions": {
    "miniflare": "3.0.1"
  }

Probably not the best idea to pin it like this long term, but it allowed me to get back to work.

Same issue, Wrangler 3.0.0, local, Windows 11. Command wrangler pages dev

Wanted to also add this popus up during try/catch

workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:215: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate
stack: 7ff76b8e8a6f 7ff76b92c9dd 0 0 0 0 0 0 0 0 0 0; sentryErrorContext = jsgInternalError

but when the whole worker response itself wraps up, it also emits

workerd/jsg/util.c++:276: error: e = kj/async-io-win32.c++:294: failed: ConnectEx(): cloudflare/workers-sdk#1225 The remote computer refused the network connection.
stack: 7ff76b8e8950 0 0 0 0 0 0 0 0 0 0 0 0 0 7ff76b8f6234; sentryErrorContext = jsgInternalError

Also WSL (Ubuntu 22) on the same computer works just fine