🐛 BUG: Wrangler dev fails to fetch()

[maddsua]

Which Cloudflare product(s) does this pertain to?

Wrangler

What version of Wrangler are you using?

3.0.0

What operating system are you using?

Windows 10

Describe the Bug

After updating to the latest version, fetch API calls started to fail in wrangler dev. Fails on any website, even the mighty google.com
Rolled back to v2.19.0 - everything works fine again.
A bit more of the context: I'm using fetch to call WIX'es REST API, via https, as expected. The 3.0 version seems much faster, so I assume that some serious changes were applied under the hood. Sometimes I can see mention of WSA in this error messages, and WSA is a part of Windows networking APIs, somewhat suspicions to me to see it here.
Well, I haven't rebooted my system after updating, we're not in 1999, shouldn't be the cause of the problem, huh 😁

Screenshot:

[mrbbot]

Hey! 👋 Thanks for raising this. I think this issue only affects secure https: fetch()es on Windows. Will try get this fixed. 👍 For now, you may want to use wrangler dev --remote which runs your Worker on the Cloudflare network, or stay on Wrangler 2 and use wrangler dev --local for local development.

[demosjarco]

Wanted to also add this popus up during try/catch

workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:215: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate
stack: 7ff76b8e8a6f 7ff76b92c9dd 0 0 0 0 0 0 0 0 0 0; sentryErrorContext = jsgInternalError

but when the whole worker response itself wraps up, it also emits

workerd/jsg/util.c++:276: error: e = kj/async-io-win32.c++:294: failed: ConnectEx(): cloudflare/workers-sdk#1225 The remote computer refused the network connection.
stack: 7ff76b8e8950 0 0 0 0 0 0 0 0 0 0 0 0 0 7ff76b8f6234; sentryErrorContext = jsgInternalError

Also WSL (Ubuntu 22) on the same computer works just fine

[kristjanmar]

Same here, unable to use plain "wrangler dev" after uprading to 3.0.0. Using Windows 11.

My app also uses fetch() to external APIs.

Using "wrangler dev --remote" appears to work with 3.0.0.

workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:215: failed: TLS peer's certificate is not trusted; reason = self signed certificate in certificate chain                      
stack: 7ff769b98a6f 7ff769bdc9dd 0 0 0 0 0 0 0 0 0 0; sentryErrorContext = jsgInternalError  

[ad6025b]

im using cloudlflare queues, and --remote does not support queues yet :(
==> cloudflare/workerd#855

catch22 ==> im dead in the water here.... please help

[TheDevMinerTV]

Same issue here:

workerd/jsg/util.c++:276: error: e = kj/compat/tls.c++:215: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate
stack: 7ff683b18a6f 7ff683b5c9dd 0 0 0 0 0 0 0 0 0 0 0 0 7ff683b26234; sentryErrorContext = jsgInternalError

(the URL being fetched here is https://www.patreon.com/api/oauth2/token )

Environment:

• Wrangler v3.0.0
• Windows 10 22H2
• Command: wrangler dev -e dev

[RichiCoder1]

Same issue, Wrangler 3.0.0, local, Windows 11. Command wrangler pages dev

[maddsua]

We probably need the "+1" button for issues at this point 😅

[captainjapeng]

im using cloudlflare queues, and --remote does not support queues yet :( ==> cloudflare/workerd#855

catch22 ==> im dead in the water here.... please help

I've managed to work around this by downgrading to Wrangler v2.20.0 and running wrangler dev --local --persist

[maddsua]

Update on Wrangler v3.0.1

Test code:

export default {
    async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {

        const result = await (await fetch('https://google.com')).text()
        console.log(result)

        return new Response('Hello World!')
    }
}

Results in console output:

⎔ Starting local server...
[mf:wrn] The latest compatibility date supported by the installed Cloudflare Workers Runtime is "2023-05-18",
but you've requested "2023-05-31". Falling back to "2023-05-18"...
[mf:inf] Ready on http://127.0.0.1:8787/
workerd/jsg/jsg.c++:133: error: took recursive isolate lock; kj::getStackTrace() = 7ff65d9fefbe 7ff65d67aa74 7ff65d87a236 7ff65d8b332a 7ff65d8b3272 7ff65d428a05 7ff65d424748 7ff65d56b3a4 7ff65d5a7d2c 7ff65d567304 7ff65d563a51 7ff65d65283c 7ff65d563a51 7ff65d6662fc 7ff65d563a51 7ff65c7cc23c 7ff65d569a1c 7ff65d563a51 7ff65d65283c 7ff65d663d1f 7ff65d663060 7ff65d4263c0 7ff65db58095 7ff65d892fd8 7ff65d8deeee 7ff65db5968f 7ff65c91bc8b 7ff65c91b6ba 7ff65c91ad9b 7ff65e1394f8
[mf:inf] GET / 200 OK (1679ms)
...
[google.com's HTML goes here, not gonna include it bc it's irrelevant]

So, it kinda fails, but also works at the same time 🤯

[bennor-akqa]

Reading between the lines of the linked PR #3352, I was able to work around this by adding the following to my package.json:

  "resolutions": {
    "miniflare": "3.0.1"
  }

Probably not the best idea to pin it like this long term, but it allowed me to get back to work.

[ad6025b]

is there an update to wrangler 3.x to fix this yet?

[mrbbot]

Hey everyone! 👋 This should be fixed with [email protected]. wrangler's version constraint for miniflare is ^3.0.0, so you should be able to run npm update miniflare to get the latest version and fix the issue now. We'll release a version of Wrangler with [email protected] set as the minimum version soon. 👍

[bryanlatten]

@mrbbot appreciate the update, unfortunately even the latest miniflare (3.0.2) doesn't seem to solve the issue either.

└─┬ [email protected]
  └── [email protected]

[bryanlatten]

if its any clue - it seems exacerbated when I attempt to run workers in the background

[scottwillmoore]

For the error failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate I found that you can export SSL_CERT_FILE to get around this problem. In my case I run export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt.

I use NixOS, and have created a reproduction at scottwillmoore/cloudflare-workers-with-nix.

EDIT: My reproduction uses [email protected].

[PANstudio]

Same issue here - can't connect to remote PG database. Running locally I get the OP's error; running with --remote I get a PG error saying proxy request failed, cannot connect to the specified address. I've updated to Wrangler 3.0.1.

[CMCDragonkai]

For the error failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate I found that you can export SSL_CERT_FILE to get around this problem. In my case I run export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt.

I use NixOS, and have created a reproduction at scottwillmoore/cloudflare-workers-with-nix.

EDIT: My reproduction uses [email protected].

Question... are you using wrangler from nixpkgs, or wrangler from node_modules?

I'm using NixOS as well, but my wrangler is from node_modules (it's installed from npm).

I'm hitting this error as well. However also setting SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt wrangler dev works as well.

That implies that my current wrangler (3.18) doesn't have built in certificates.

└─┬ [email protected]
├─┬ [email protected]

Either wrangler should default 74c8b85 but it also makes sense that in NixOS, it should refer to the OS certs.

[non-bin]

Anyone having this issue on NixOS, use

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

as suggested here https://github.com/scottwillmoore/cloudflare-workers-with-nix?tab=readme-ov-file

Or add this to your home-manager config

{
  home.sessionVariables = {
    SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt";
  };
}