jibo-ssm (WiFiManager._checkJiboServers()) performs periodic https.get health checks using Node's internal compiled-in CA bundle, ignoring OS-level trust stores in /etc/ssl/certs.
Without setting export NODE_TLS_REJECT_UNAUTHORIZED=0 prior to starting jibo-system-manager, Node's TLS check fails every ~60 seconds, triggering ErrorService.addError('Q4-Server_connection_lost').
Suggested Resolution
Add export NODE_TLS_REJECT_UNAUTHORIZED=0 to /etc/init.d/S78jibo-system-manager or configure default environment variables for Node.js services.
### Problem Description
`jibo-ssm` (`WiFiManager._checkJiboServers()`) performs periodic `https.get` health checks using Node's internal compiled-in CA bundle, ignoring OS-level trust stores in `/etc/ssl/certs`.
Without setting `export NODE_TLS_REJECT_UNAUTHORIZED=0` prior to starting `jibo-system-manager`, Node's TLS check fails every ~60 seconds, triggering `ErrorService.addError('Q4-Server_connection_lost')`.
### Suggested Resolution
Add `export NODE_TLS_REJECT_UNAUTHORIZED=0` to `/etc/init.d/S78jibo-system-manager` or configure default environment variables for Node.js services.
Depending on Troposphere's target deployment model, here are two options for addressing the Node.js TLS health check failures:
Option A: export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt(Recommended for security)
Instructs Node.js to load custom/local root CAs installed in the OS trust store (/etc/ssl/certs) alongside Node's built-in bundle. This preserves full TLS verification while allowing custom local or revival server CAs installed on the robot to be trusted.
Option B: export NODE_TLS_REJECT_UNAUTHORIZED=0
Disables Node.js TLS verification completely. Simple and effective for local/offline revival environments, self-signed certificates, or direct IP connections, but disables certificate validation for Node processes managed by the supervisor.
### Additional Context & Solution Options
Depending on Troposphere's target deployment model, here are two options for addressing the Node.js TLS health check failures:
#### Option A: `export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt` *(Recommended for security)*
Instructs Node.js to load custom/local root CAs installed in the OS trust store (`/etc/ssl/certs`) alongside Node's built-in bundle. This preserves full TLS verification while allowing custom local or revival server CAs installed on the robot to be trusted.
#### Option B: `export NODE_TLS_REJECT_UNAUTHORIZED=0`
Disables Node.js TLS verification completely. Simple and effective for local/offline revival environments, self-signed certificates, or direct IP connections, but disables certificate validation for Node processes managed by the supervisor.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem Description
jibo-ssm(WiFiManager._checkJiboServers()) performs periodichttps.gethealth checks using Node's internal compiled-in CA bundle, ignoring OS-level trust stores in/etc/ssl/certs.Without setting
export NODE_TLS_REJECT_UNAUTHORIZED=0prior to startingjibo-system-manager, Node's TLS check fails every ~60 seconds, triggeringErrorService.addError('Q4-Server_connection_lost').Suggested Resolution
Add
export NODE_TLS_REJECT_UNAUTHORIZED=0to/etc/init.d/S78jibo-system-manageror configure default environment variables for Node.js services.Additional Context & Solution Options
Depending on Troposphere's target deployment model, here are two options for addressing the Node.js TLS health check failures:
Option A:
export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt(Recommended for security)Instructs Node.js to load custom/local root CAs installed in the OS trust store (
/etc/ssl/certs) alongside Node's built-in bundle. This preserves full TLS verification while allowing custom local or revival server CAs installed on the robot to be trusted.Option B:
export NODE_TLS_REJECT_UNAUTHORIZED=0Disables Node.js TLS verification completely. Simple and effective for local/offline revival environments, self-signed certificates, or direct IP connections, but disables certificate validation for Node processes managed by the supervisor.