Can the SurrealDB JavaScript client use a custom CA while still enforcing hostname verification?

Question

Goal: Configure the SurrealDB JavaScript client to trust a custom certificate authority while still enforcing hostname verification during TLS handshake.

Constraints: The client’s `tls` option accepts a `ca` array for custom CAs and a `rejectUnauthorized` flag that mirrors Node.js TLS settings. Setting `rejectUnauthorized: false` disables all validation, but the documentation does not specify whether supplying a custom CA with `rejectUnauthorized: true` also enables hostname verification, nor how the `ca` option interacts with the underlying `checkServerIdentity` function.

Questions: Does providing a custom CA via the `ca` option automatically enable hostname verification when `rejectUnauthorized` is true? Is there a way to set `checkServerIdentity` explicitly in the SurrealDB JavaScript client to enforce hostname verification while using a custom CA?

Tasadduq Burney · Answer

Yes. Supplying a custom CA through the `ca` option does not affect hostname verification; as long as `rejectUnauthorized` is set to true the TLS stack still performs checkServerIdentity and validates the server name against the certificate’s SAN.
Confirmed facts: In Node.js TLS, `rejectUnauthorized: true` enforces both chain validation and hostname verification. The `ca` array only replaces the set of trusted root certificates; it does not disable or modify the hostname check.
Steps to achieve the goal:

Set `rejectUnauthorized: true` in the client’s `tls` options.
Provide your custom CA(s) in the `ca` array.
Verify that the client forwards the `checkServerIdentity` option to the underlying TLS library. If the client uses the WebSocket engine (the default), this is supported; if it uses the HTTP engine, you may need a custom dispatcher or agent.
If `checkServerIdentity` cannot be passed, you cannot enforce hostname verification beyond the default, and you must rely on the certificate’s SAN matching the host name.

If you are unsure whether the client forwards `checkServerIdentity`, please tell me which TLS engine your SurrealDB instance uses (WebSocket vs HTTP). That information will determine whether additional configuration is required.

Can the SurrealDB JavaScript client use a custom CA while still enforcing hostname verification?

1 answer

Your perspective belongs here.

0 question comments