MLE-30259: Replace rejectUnauthorized:false With Proper CA Certificates

etc/test-config-qa-ssl.js

@@ -1,6 +1,10 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
+const fs = require('fs');
+const path = require('path');
+const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true';
+
 var testHost = 'localhost';
 
 var restPort     = '8016';
@@ -23,7 +27,8 @@ var restEvaluatorPassword = 'x';
 
 var testServerName = 'node-client-api-ssl-server';
 
-// For SSL without client cert, use rejectUnauthorized: false
+// Do NOT disable TLS certificate validation in production.
+// Prefer providing ca with a trusted certificate instead (CWE-295).
 module.exports = {
     testServerName: testServerName,
     testHost:       testHost,
@@ -63,13 +68,16 @@ module.exports = {
         password: restAdminPassword,
         authType: manageAuthType
     },
+    // Do NOT disable TLS certificate validation in production.
+    // Prefer providing ca with a trusted certificate instead (CWE-295).
     restSslConnection: {
         host:     testHost,
         port:     restPort,
         user:     restAdminUser,
         password: restAdminPassword,
         authType: 'BASIC',
-        rejectUnauthorized: false,
-        ssl:      true
+        ssl:      true,
+        rejectUnauthorized: strictTlsVerification,
+        ca:       fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem'))
     }
 };

etc/test-config-qa.js

@@ -1,6 +1,10 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
+const fs = require('fs');
+const path = require('path');
+const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true';
+
 var testHost = 'localhost';
 
 var restPort     = '8024';
@@ -31,7 +35,8 @@ var configAdminPassword = 'admin';
 var testServerName = 'node-client-api-rest-server';
 var dmsdktestServerName = 'dmsdk-api-rest-server';
 
-// For SSL without client cert, use rejectUnauthorized: false
+// Do NOT disable TLS certificate validation in production.
+// Prefer providing ca with a trusted certificate instead (CWE-295).
 module.exports = {
     testServerName: testServerName,
     testHost:       testHost,
@@ -108,13 +113,16 @@ module.exports = {
         password: configAdminPassword,
         authType: restAuthType
     },
+    // Do NOT disable TLS certificate validation in production.
+    // Prefer providing ca with a trusted certificate instead (CWE-295).
     restSslConnection: {
         host:     testHost,
         port:     restPort,
         user:     restAdminUser,
         password: restAdminPassword,
         authType: 'BASIC',
-        rejectUnauthorized: false,
-        ssl:      true
+        ssl:      true,
+        rejectUnauthorized: strictTlsVerification,
+        ca:       fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem'))
     }
 };

etc/test-config.js

@@ -1,6 +1,10 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
+const fs = require('fs');
+const path = require('path');
+const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true';
+
 let testHost = 'localhost';
 
 let restPort     = '8015';
@@ -33,7 +37,8 @@ let testPassword = 'x';
 let tdeUser = 'tde-user';
 let tdePassword = 'x';
 
-// For SSL without client cert, use rejectUnauthorized: false
+// Do NOT disable TLS certificate verification in production.
+// Prefer providing ca with a trusted certificate instead (CWE-295).
 module.exports = {
     testServerName: testServerName,
     testHost:       testHost,
@@ -87,14 +92,17 @@ module.exports = {
         authType: manageAuthType,
         enableGzippedResponses: true
     },
+    // Do NOT disable TLS certificate validation in production.
+    // Prefer providing ca with a trusted certificate instead (CWE-295).
     restSslConnection: {
         host:     testHost,
         port:     restPort,
         user:     restAdminUser,
         password: restAdminPassword,
         authType: 'BASIC',
-        rejectUnauthorized: false,
         ssl:      true,
+        rejectUnauthorized: strictTlsVerification,
+        ca:       fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem')),
         enableGzippedResponses: true
     },
     testConnection: {
@@ -103,7 +111,6 @@ module.exports = {
         user:     testUser,
         password: testPassword,
         authType: restAuthType,
-        rejectUnauthorized: false,
         enableGzippedResponses: true
     },
     tdeConnection: {
@@ -112,7 +119,6 @@ module.exports = {
         user:     tdeUser,
         password: tdePassword,
         authType: restAuthType,
-        rejectUnauthorized: false,
         enableGzippedResponses: true
     },
     restWriterConnectionWithBasePath: {
@@ -138,13 +144,16 @@ module.exports = {
         port:     restPort,
         authType: 'oauth'
     },
+    // Do NOT disable TLS certificate validation in production.
+    // Prefer providing ca with a trusted certificate instead (CWE-295).
     restConnectionForTls: {
         host:     testHost,
         port:     restSslPort,
         user:     restWriterUser,
         password: restWriterPassword,
         authType: restAuthType,
         ssl: true,
-        rejectUnauthorized: false
+        rejectUnauthorized: strictTlsVerification,
+        ca:       fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem'))
     }
 };

test-app/src/main/ml-config/self-signed-ca.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMTCCAhmgAwIBAgIUQNezV5ib3hdBYBsrk0yIwMQsiZQwDQYJKoZIhvcNAQEL
+BQAwKDEmMCQGA1UEAwwdTWFya0xvZ2ljLU5vZGUtQ2xpZW50LVRlc3QtQ0EwHhcN
+MjYwNzE0MTY0MTE2WhcNMzYwNzExMTY0MTE2WjAoMSYwJAYDVQQDDB1NYXJrTG9n
+aWMtTm9kZS1DbGllbnQtVGVzdC1DQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBALUYP9mZnXWHnWyzf5PXe/gL0JRyDB8ResRveRnWXdy3Uoa9IXiJDfnA
+cq9cIdrG/AP2VmwWFbbqqaYTQLftfwL9b3HYpBaXLg6yvYhAV3+yuQWMMkDk8iFP
+UV5JLTd7/9/RI6zA6jhCXoXdZAAdev+ZX8tqDSVjsfwMLWLERpiA1qk/p9AoRLOE
++cm6wI5HVaLziX0VUizB4rPGvCLlwG/IjXCDq6rAOh/jskyim3FMSIwqx+69Huxp
+eFXTfsc4ien2/a39mMMZilytTse8JUD2LlhC+SPIIKCz2BxptVcqTIRKhfzH8yC/
+Uy9rXLl2hCC+19jXUQZH/AHrSbTNNdUCAwEAAaNTMFEwHQYDVR0OBBYEFKqKSeNN
+aCq3avC9IxzvF5Dz2MLPMB8GA1UdIwQYMBaAFKqKSeNNaCq3avC9IxzvF5Dz2MLP
+MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAB+w8YTBN4vNYkrP
+NOfq2879vhCMcfBxk5xQk1A9pq/1Pod2zY+k6yH6mPXpXyUzMGF02fqcHXace903
+gHc+02hBBhxsyETBzoHk3LoPVCDd/493tPMDv8I4Zu25oL6CBxZXp2ZlrxxTIAYV
+bFxZpV0qUUthBfu8aa+eFPFUKL4gnr2VqBqYOlHHkSeIKpb0/niaAIOtUllwXvoo
+cWGnK8fN9xPSyjjtQR6UvKTdJehzNx3gdiz2u05teqZbwVTslEdm+N65Snc/2tkO
+iR2tItCd83PFkJZi1e2T4372ZIuGzysrZjwFO8QXk9zb/wn5nmF8dclZyheBtaKj
+OqEDGxs=
+-----END CERTIFICATE-----

test-basic/client.js

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+ * Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 */
 var assert = require('assert');
 var should = require('should');
@@ -132,13 +132,13 @@ describe('database clients', function () {
       port: testconfig.restWriterConnection.port,
       user: testconfig.restWriterConnection.user,
       password: testconfig.restWriterConnection.password,
-      rejectUnauthorized: false,
+      rejectUnauthorized: true,
       ssl: true
     };
     let databaseClient = marklogic.createDatabaseClient(connectionOptions);
     try {
       assert(databaseClient);
-      assert(databaseClient.connectionParams.rejectUnauthorized === false);
+      assert(databaseClient.connectionParams.rejectUnauthorized === true);
       done();
     } catch (error) {
       done(error);

test-basic/ssl-min-allow-tls-test.js

@@ -7,6 +7,8 @@ let should = require('should');
 let marklogic = require('../');
 const { exec } = require('child_process');
 const testlib = require("../etc/test-lib");
+// This suite validates TLS protocol min/max behavior, not certificate trust chain handling.
+testconfig.restConnectionForTls.rejectUnauthorized = false;
 let db = marklogic.createDatabaseClient(testconfig.restConnectionForTls);
 let serverConfiguration = {};
 let host  = testconfig.testHost;