title: nodejs ssl "unable to get local issuer certificate"
body: <p>I've been given an SSL cert to use for signing client requests, as well as the relevant CA certs. I can verify it using openssl:</p>
  
  <pre><code>$ openssl s_client -CAfile /etc/ssl/foo/ca-combined.pem -servername foo.co.in -connect foo.co.in:443
  CONNECTED(00000003)
  ... snip ...
  Verify return code: 0 (ok)
  ---
  closed
  </code></pre>
  
  <p>(I mashed the 2 CA certs into one file). But when I try to replicate it using node:</p>
  
  <pre><code>    var tls = require('tls');
      var fs = require('fs');
  
      var options = { 
          host: 'foo.co.in',
          servername: 'foo.co.in',
          port: 443,
          key: fs.readFileSync('/etc/ssl/private/foo.key'),
          cert: fs.readFileSync('/etc/ssl/foo/cert.pem'),
          ca: [fs.readFileSync('/etc/ssl/foo/combined-ca.pem')]
      };  
  
      tls.connect(options, function(err) {
          done(err);
      });
  </code></pre>
  
  <p>I get an error:</p>
  
  <pre><code>Uncaught Error: unable to get local issuer certificate
    at Error (native)
    at TLSSocket.&lt;anonymous&gt; (_tls_wrap.js:1092:38)
    at TLSSocket._finishInit (_tls_wrap.js:610:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:440:38)
  </code></pre>
  
  <p>I found an answer on here, suggesting that I need to put each CA cert in a separate file:</p>
  
  <pre><code>ca: [fs.readFileSync('/etc/ssl/foo/ca.pem'), fs.readFileSync('/etc/ssl/foo/root-ca.pem')]
  </code></pre>
  
  <p>but that still gave the same error. (I also tried reversing the order). I then tried putting the intermediate cert in with the client one, and just providing the root CA cert as ca (which seems to be what the <a href="https://nodejs.org/dist/latest-v6.x/docs/api/tls.html#tls_tls_createsecurecontext_options" rel="noreferrer">docs</a> suggest), same error. At this point I'm running out of ideas. The fact that openssl is happy suggests that I'm doing something wrong, any suggestions?</p>
  
  <pre><code>$ node --version
  v6.10.1
  </code></pre>
  
  <p>(I realise I can set rejectUnauthorized to false, but I'd really rather not)</p>