'Hostname/IP does not match certificate' error when proxying HTTPS via HTTP (CONNECT) proxy

[christopherjturner]

After upgrading global agent from 3.0.0 to 4.1.3 HTTPS calls made though a HTTP proxy (using a CONNECT tunnel) fail due to the certs not matching the hostname.

Client request error: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com

It feels like the secureEndpoint flag isn't being set correctly in this scenario, so the servername in the TLS options is never set?

Steps to reproduce:

1. Start an HTTP proxy on localhost:3128 (https://opensource.saucelabs.com/forwarder/)
2. Set GLOBAL_AGENT_HTTP_PROXY=http://127.0.0.1:3128
3. call bootstrap()
4. Make https call await Wreck.get('https://www.github.com')
5. Call fails with Client request error: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com

Trace logs

Trace: {
  destination: 'https://www.github.com/',
  proxy: 'http://127.0.0.1:3128',
  requestId: 1
} proxying request
    at Object.trace (***/node_modules/global-agent/dist/Logger.js:47:25)
    at BoundHttpsProxyAgent.addRequest (***/node_modules/global-agent/dist/classes/Agent.js:125:13)
    at new ClientRequest (node:_http_client:404:16)
    at request (node:https:633:10)
    at Object.request (***/node_modules/global-agent/dist/utilities/bindHttpMethod.js:47:20)
    at internals.Client._request (***/node_modules/@hapi/wreck/lib/index.js:186:28)
    at internals.Client.request (***/node_modules/@hapi/wreck/lib/index.js:76:26)
    at internals.Client._shortcut (***/node_modules/@hapi/wreck/lib/index.js:549:32)
    at internals.Client.get (***/node_modules/@hapi/wreck/lib/index.js:524:21)
    at handler (***/src/api/example/controllers/proxy-controller.js:6:51)
    at exports.Manager.execute (***/node_modules/@hapi/hapi/lib/toolkit.js:57:29)
    at internals.handler (***/node_modules/@hapi/hapi/lib/handler.js:46:48)
    at exports.execute (***/node_modules/@hapi/hapi/lib/handler.js:31:36)
    at Request._lifecycle (***/node_modules/@hapi/hapi/lib/request.js:370:68)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async Request._execute (***/node_modules/@hapi/hapi/lib/request.js:280:9)
Trace: {
  target: {
    host: 'www.github.com',
    port: 443,
    proxy: { authorization: null, hostname: '127.0.0.1', port: 3128 },
    tls: {}
  }
} connecting
    at Object.trace (***/node_modules/global-agent/dist/Logger.js:47:25)
    at ***/node_modules/global-agent/dist/classes/Agent.js:180:17
    at Socket.<anonymous> (/***/node_modules/global-agent/dist/classes/HttpsProxyAgent.js:36:13)
    at Object.onceWrapper (node:events:623:26)
    at Socket.emit (node:events:508:28)
    at Socket.emit (node:domain:489:12)
    at addChunk (node:internal/streams/readable:559:12)
    at readableAddChunkPushByteMode (node:internal/streams/readable:510:3)
    at Readable.push (node:internal/streams/readable:390:5)
    at TCP.onStreamRead (node:internal/stream_base_commons:189:23)
created socket undefined
{
  error: {
    code: 'ERR_TLS_CERT_ALTNAME_INVALID',
    reason: "Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com",
    host: 'localhost',
    cert: {
      subject: [Object],
      issuer: [Object],
      subjectaltname: 'DNS:github.com, DNS:www.github.com',
      infoAccess: [Object],
      ca: false,
      modulus: undefined,
      exponent: undefined,
      pubkey: '[object Buffer]',
      bits: 256,
      valid_from: 'Mar  6 00:00:00 2026 GMT',
      valid_to: 'Jun  3 23:59:59 2026 GMT',
      fingerprint: 'AB:58:EA:12:8B:A9:2C:A6:9A:31:B3:6B:4E:54:56:53:EE:D2:A6:CF',
      fingerprint256: '97:16:D3:94:41:CA:65:1C:51:BE:78:E9:69:CA:38:5E:C2:13:EC:17:71:5B:8C:91:F0:1E:E6:52:F9:0F:C6:2C',
      fingerprint512: '1B:67:EA:78:02:24:7D:6E:24:93:4E:32:8B:B5:AA:9B:52:5C:47:63:6C:5C:E6:04:F6:1B:6A:9A:45:CB:C1:8D:1D:8C:6A:85:9A:A1:73:B1:25:27:87:37:70:8B:BA:DD:29:87:32:3A:76:D5:7F:A3:EF:AE:41:F4:32:93:4E:39',
      ext_key_usage: [Array],
      serialNumber: '1DC289C1EADAFB04E9D1CF53D5D72253',
      raw: '[object Buffer]',
      asn1Curve: 'prime256v1',
      nistCurve: 'P-256',
      issuerCertificate: [Object]
    },
    name: 'Error',
    message: "Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com",
    stack: "Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com\n" +
      '    at Object.checkServerIdentity (node:tls:455:12)\n' +
      '    at TLSSocket.onConnectSecure (node:_tls_wrap:1641:27)\n' +
      '    at TLSSocket.emit (node:events:508:28)\n' +
      '    at TLSSocket.emit (node:domain:489:12)\n' +
      '    at TLSSocket._finishInit (node:_tls_wrap:1077:8)\n' +
      '    at ssl.onhandshakedone (node:_tls_wrap:863:12)'
  }
} socket error
{
  error: {
    code: 'ERR_TLS_CERT_ALTNAME_INVALID',
    reason: "Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com",
    host: 'localhost',
    cert: {
      subject: [Object],
      issuer: [Object],
      subjectaltname: 'DNS:github.com, DNS:www.github.com',
      infoAccess: [Object],
      ca: false,
      modulus: undefined,
      exponent: undefined,
      pubkey: '[object Buffer]',
      bits: 256,
      valid_from: 'Mar  6 00:00:00 2026 GMT',
      valid_to: 'Jun  3 23:59:59 2026 GMT',
      fingerprint: 'AB:58:EA:12:8B:A9:2C:A6:9A:31:B3:6B:4E:54:56:53:EE:D2:A6:CF',
      fingerprint256: '97:16:D3:94:41:CA:65:1C:51:BE:78:E9:69:CA:38:5E:C2:13:EC:17:71:5B:8C:91:F0:1E:E6:52:F9:0F:C6:2C',
      fingerprint512: '1B:67:EA:78:02:24:7D:6E:24:93:4E:32:8B:B5:AA:9B:52:5C:47:63:6C:5C:E6:04:F6:1B:6A:9A:45:CB:C1:8D:1D:8C:6A:85:9A:A1:73:B1:25:27:87:37:70:8B:BA:DD:29:87:32:3A:76:D5:7F:A3:EF:AE:41:F4:32:93:4E:39',
      ext_key_usage: [Array],
      serialNumber: '1DC289C1EADAFB04E9D1CF53D5D72253',
      raw: '[object Buffer]',
      asn1Curve: 'prime256v1',
      nistCurve: 'P-256',
      issuerCertificate: [Object]
    },
    name: 'Error',
    message: "Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com",
    stack: "Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:github.com, DNS:www.github.com\n" +
      '    at Object.checkServerIdentity (node:tls:455:12)\n' +
      '    at TLSSocket.onConnectSecure (node:_tls_wrap:1641:27)\n' +
      '    at TLSSocket.emit (node:events:508:28)\n' +
      '    at TLSSocket.emit (node:domain:489:12)\n' +
      '    at TLSSocket._finishInit (node:_tls_wrap:1077:8)\n' +
      '    at ssl.onhandshakedone (node:_tls_wrap:863:12)'
  }
} request error

[chr4ss12]

global-agent does not work with the axios latest library 1.3.6 using proxy:false option,

getting similar error regarding certificates:

cause]: Error: write EPROTO 0071BE0202000000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls alert handshake failure:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 40

  at ignore-listed frames {
errno: -100,
code: 'EPROTO',

Claude has generated me a patch that fixes the issue, however I've not stress tested this, and again, no idea if this is correct, however it does work:

diff --git a/node_modules/global-agent/dist/classes/Agent.js b/node_modules/global-agent/dist/classes/Agent.js
index 4a31fe5..57144bd 100644
--- a/node_modules/global-agent/dist/classes/Agent.js
+++ b/node_modules/global-agent/dist/classes/Agent.js
@@ -153,7 +153,7 @@ class Agent {
         // > are also accepted:
         // >   ca, cert, ciphers, clientCertEngine, crl, dhparam, ecdhCurve, honorCipherOrder,
         // >   key, passphrase, pfx, rejectUnauthorized, secureOptions, secureProtocol, servername, sessionIdContext.
-        if (configuration.secureEndpoint) {
+        if (configuration.secureEndpoint || this.protocol === 'https:') {
             // Determine servername - Node.js doesn't allow IP addresses as servername
             const host = (_f = configuration.servername) !== null && _f !== void 0 ? _f : connectionConfiguration.host;
             const servername = net_1.default.isIP(host) ? undefined : host;

[viceice]

maybe related to

• Default rejectUnauthorized to true & match Node's NODE_TLS_REJECT_UNAUTHORIZED logic #48
• 3735fa1#diff-e4fc2e34908f32cb0fa10df7decad866a7ba7f4c5a75cad0fa9b079ad880016aR156

[qomhmd]

+1

[feitianbubu]

Ran into this on global-agent@4.1.3 as well (Node v22.18.0) and can confirm the suspicion in the issue description: options.secureEndpoint is never set at the time Node core invokes Agent#addRequest. This is not specific to got/axios/wreck — plain https.get doesn't set it either:

$ node -e 'const https=require("https");https.globalAgent.addRequest=(req,opts)=>{console.log("secureEndpoint:",opts.secureEndpoint,"servername:",opts.servername);req.destroy();};https.get("https://example.com").on("error",()=>{});'
secureEndpoint: undefined servername: undefined

secureEndpoint is an agent-base convention, not a Node core one. Node core only computes servername later, in Agent#createSocket via calculateServerName, and global-agent's custom addRequest path never reaches that code. So connectionConfiguration.tls stays {} (visible as tls: {} in the trace logs above) and HttpsProxyAgent#createConnection ends up calling tls.connect() with no servername — the TLS handshake inside the CONNECT tunnel carries no SNI.

Two consequences beyond the cert-mismatch errors already reported:

• Since the whole TLS options block is skipped, per-request TLS options (rejectUnauthorized, ca, client certificates) are silently ignored too, not just SNI.
• Another failure signature to help people find this issue: Google endpoints (e.g. oauth2.googleapis.com) answer SNI-less handshakes with a placeholder certificate (CN=invalid2.invalid, OU=No SNI provided - please fix your client.), so every proxied request fails with DEPTH_ZERO_SELF_SIGNED_CERT.

Here is a self-contained repro that needs no external proxy or endpoint. It starts a local CONNECT proxy and a TLS server that records the SNI it receives, then makes a request through global-agent (npm i global-agent got, cert pair via openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 1 -nodes -subj '/CN=test.example.com'):

import net from 'node:net';
import tls from 'node:tls';
import fs from 'node:fs';

const cert = fs.readFileSync('cert.pem');
const key = fs.readFileSync('key.pem');
let receivedSni = '<none>';

const tlsServer = tls.createServer({
  cert, key,
  SNICallback: (servername, cb) => { receivedSni = servername; cb(null, tls.createSecureContext({ cert, key })); },
}, (socket) => { socket.on('data', () => socket.end('HTTP/1.1 200 OK\r\ncontent-length: 2\r\nconnection: close\r\n\r\nok')); });

const proxy = net.createServer((client) => {
  client.once('data', (data) => {
    if (!/^CONNECT /.test(data.toString())) return client.destroy();
    const upstream = net.connect(tlsServer.address().port, '127.0.0.1', () => {
      client.write('HTTP/1.1 200 Connection established\r\n\r\n');
      client.pipe(upstream).pipe(client);
    });
  });
});

await new Promise((r) => tlsServer.listen(0, '127.0.0.1', r));
await new Promise((r) => proxy.listen(0, '127.0.0.1', r));
process.env.GLOBAL_AGENT_HTTP_PROXY = `http://127.0.0.1:${proxy.address().port}`;

const { bootstrap } = await import('global-agent');
bootstrap();
const got = (await import('got')).default;
try {
  const res = await got('https://test.example.com/', { https: { rejectUnauthorized: false }, timeout: { request: 3000 }, retry: { limit: 0 } });
  console.log('request ok:', res.statusCode, res.body);
} catch (e) { console.log('request error:', e.message); }
console.log('SNI received by server:', receivedSni);
process.exit(0);

Results on Node v22.18.0:

version	output
4.1.3	request error: self-signed certificate (despite rejectUnauthorized: false), SNI received by server: <none>
4.1.3 + the one-line change from #86	request ok: 200 ok, SNI received by server: test.example.com
3.0.0	request ok: 200 ok, SNI received by server: test.example.com

3.0.0 is unaffected because it gates the TLS block with this.protocol === 'https:' and always sets servername; the regression came in with the switch to configuration.secureEndpoint (commit linked by @viceice above). I applied the exact diff from #86 locally and it fixes both the missing SNI and the ignored per-request TLS options, so merging that PR would resolve this issue.