Apollo federation - self signed certificate in certificate chain error with subgraph

[pkunwor]

Hi,
I am trying to implement apollo federation with multiple subgraphs. I am able to create supergraph and start the server locally, however getting “self signed certificate in certificate chain” error when issuing query. The subgraphs are protected with company authorization. Following is the main code for apollo gateway.

Any suggestions on what can I do for the error?

const { ApolloServer } = require(‘apollo-server’);
const { ApolloGateway, RemoteGraphQLDataSource } = require(’@apollo/gateway’);
const { readFileSync } = require(‘fs’);

const supergraphSdl = readFileSync(’./supergraph.graphql’).toString();

class AuthenticatedDataSource extends RemoteGraphQLDataSource {
willSendRequest({ request, context }) {

//Sending hard coded token value for testing locally
return ‘Bearer’ +
}
}

const gateway = new ApolloGateway({
supergraphSdl,
buildService({ name, url }) {
return new AuthenticatedDataSource({ url });
},
subscriptions: false,
NODE_TLS_REJECT_UNAUTHORIZED: false

});

const server = new ApolloServer({
gateway

});

server.listen().then(({ url }) => {
console.log(🚀 Gateway ready at ${url});
}).catch(err => {console.error(err)});

Thank You,

[glasser]

Do your subgraphs in fact have self-signed certificates?

It looks like you're trying to turn off this check with NODE_TLS_REJECT_UNAUTHORIZED. That's not an option to new ApolloGateway; it's an environment variable you set when running your script (eg, you put NODE_TLS_REJECT_UNAUTHORIZED=0 on the command line before node). You can also add process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0; near the top of your app. However, this does disable security features! You probably should instead get the root certificate for your setup added to your Node process.

[americoperez49]

What is the solution for this in Production? I have a self hosted website app (frontend and backend) inside a LAN. It will only ever be accessible over an Intranet. I need to use self-signed certificates for this. I dont want to just turn of the security features. I want to do it the correct way.