[Bug] jibo-ssm health check failures (Q4-Server_connection_lost) due to Node.js TLS verification #2

Open
opened 2026-08-02 18:28:25 +00:00 by ghchinoy · 1 comment
ghchinoy commented 2026-08-02 18:28:25 +00:00 (Migrated from github.com)

Problem Description

jibo-ssm (WiFiManager._checkJiboServers()) performs periodic https.get health checks using Node's internal compiled-in CA bundle, ignoring OS-level trust stores in /etc/ssl/certs.

Without setting export NODE_TLS_REJECT_UNAUTHORIZED=0 prior to starting jibo-system-manager, Node's TLS check fails every ~60 seconds, triggering ErrorService.addError('Q4-Server_connection_lost').

Suggested Resolution

Add export NODE_TLS_REJECT_UNAUTHORIZED=0 to /etc/init.d/S78jibo-system-manager or configure default environment variables for Node.js services.

### Problem Description `jibo-ssm` (`WiFiManager._checkJiboServers()`) performs periodic `https.get` health checks using Node's internal compiled-in CA bundle, ignoring OS-level trust stores in `/etc/ssl/certs`. Without setting `export NODE_TLS_REJECT_UNAUTHORIZED=0` prior to starting `jibo-system-manager`, Node's TLS check fails every ~60 seconds, triggering `ErrorService.addError('Q4-Server_connection_lost')`. ### Suggested Resolution Add `export NODE_TLS_REJECT_UNAUTHORIZED=0` to `/etc/init.d/S78jibo-system-manager` or configure default environment variables for Node.js services.
ghchinoy commented 2026-08-02 18:31:40 +00:00 (Migrated from github.com)

Additional Context & Solution Options

Depending on Troposphere's target deployment model, here are two options for addressing the Node.js TLS health check failures:

Option A: export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt (Recommended for security)

Instructs Node.js to load custom/local root CAs installed in the OS trust store (/etc/ssl/certs) alongside Node's built-in bundle. This preserves full TLS verification while allowing custom local or revival server CAs installed on the robot to be trusted.

Option B: export NODE_TLS_REJECT_UNAUTHORIZED=0

Disables Node.js TLS verification completely. Simple and effective for local/offline revival environments, self-signed certificates, or direct IP connections, but disables certificate validation for Node processes managed by the supervisor.

### Additional Context & Solution Options Depending on Troposphere's target deployment model, here are two options for addressing the Node.js TLS health check failures: #### Option A: `export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt` *(Recommended for security)* Instructs Node.js to load custom/local root CAs installed in the OS trust store (`/etc/ssl/certs`) alongside Node's built-in bundle. This preserves full TLS verification while allowing custom local or revival server CAs installed on the robot to be trusted. #### Option B: `export NODE_TLS_REJECT_UNAUTHORIZED=0` Disables Node.js TLS verification completely. Simple and effective for local/offline revival environments, self-signed certificates, or direct IP connections, but disables certificate validation for Node processes managed by the supervisor.
Sign in to join this conversation.