Nitro proxy SSL and CA certificate validation during SSR fetch

Direct Answer

Use nitro.fetch.agent.https in nuxt.config.ts to inject a custom https.Agent loaded with your private CA bundle. This scopes trust to server-side fetch only, avoiding NODE_TLS_REJECT_UNAUTHORIZED=0. For route-specific proxies, return a $fetch instance with a dedicated agent from a custom proxy handler in routeRules.

Confirmed Configuration (Nuxt 3.8+)

1. Place your CA bundle (PEM format, full chain) in a project-accessible path, e.g., ./certs/internal-ca.pem.
2. In nuxt.config.ts, create the agent at build time and assign it:

import { defineNuxtConfig } from 'nuxt/config'
import { readFileSync } from 'fs'
import { https } from 'node:https'

const caCerts = readFileSync('./certs/internal-ca.pem', 'utf-8')

const httpsAgent = new https.Agent({
  ca: caCerts,
  rejectUnauthorized: true
})

export default defineNuxtConfig({
  nitro: {
    fetch: {
      agent: {
        https: httpsAgent
      }
    }
  }
})

All server-side useFetch/$fetch calls now validate against your private CA. Client-side requests remain on the browser trust store.

Route-Specific Proxy (When Needed)

If only certain proxied routes require the private CA, define a custom proxy handler:

// server/utils/internal-fetch.ts
import { createFetch } from 'ofetch'
import { https } from 'node:https'
import { readFileSync } from 'fs'

const ca = readFileSync('./certs/internal-ca.pem', 'utf-8')
const agent = new https.Agent({ ca, rejectUnauthorized: true })

export const internalFetch = createFetch({
  agent
})

// nuxt.config.ts
export default defineNuxtConfig({
  routeRules: {
    '/api/internal/**': {
      proxy: { to: 'https://internal-api/**' },
      handler: (event) => internalFetch(event.node.req.url, { baseURL: 'https://internal-api' })
    }
  }
})

Note: The handler pattern above is illustrative; Nitro 3.x proxy handlers receive event and should return a response. Consult current Nitro docs for exact signature.

Alternative: NODE_EXTRA_CA_CERTS

Set NODE_EXTRA_CA_CERTS=/app/certs/internal-ca.pem in the container/process environment. This augments Node's default trust store for the current process only—no code changes required. Verify with node -e "console.log(require('https').globalAgent.options.ca?.length)".

Verification Steps

1. Add a test server route: server/routes/health.get.ts fetching https://your-internal-api/health.
2. Run dev server, hit the route, confirm 200 without UNABLE_TO_VERIFY_LEAF_SIGNATURE.
3. In Nuxt DevTools Network tab (SSR section), inspect the proxied request for TLS errors.
4. From the deployment host, run: openssl s_client -connect your-internal-api:443 -CAfile /path/to/ca.pem -verify_return_error to validate the chain independently.

Assumptions & Uncertainty

• Assumes Nuxt 3.8+ with stabilized experimental.fetch (enabled by default). Older versions may need nitro.experimental.fetch: true.
• CA file must be PEM; DER/CRT require conversion (openssl x509 -inform der -in cert.crt -out cert.pem).
• Hot module replacement in dev may cache the agent; restart dev server after CA changes.
• Docker/K8s: mount CA file into container and reference the mounted path in readFileSync.
• The custom proxy handler signature for routeRules may vary by Nitro version—verify against your installed version's types.

One Diagnostic Detail Needed

What Nuxt/Nitro version are you running? The nitro.fetch.agent API stabilized in Nuxt 3.8; earlier versions may require experimental.fetch or a Nitro plugin approach.