{"action":"opened","issue":{"url":"https://api.github.com/repos/request/request/issues/1583","labels_url":"https://api.github.com/repos/request/request/issues/1583/labels{/name}","comments_url":"https://api.github.com/repos/request/request/issues/1583/comments","events_url":"https://api.github.com/repos/request/request/issues/1583/events","html_url":"https://github.com/request/request/issues/1583","id":77268712,"number":1583,"title":"Error: custom CA behind corporate proxy","user":{"login":"mainakae","id":5337692,"avatar_url":"https://avatars.githubusercontent.com/u/5337692?v=3","gravatar_id":"","url":"https://api.github.com/users/mainakae","html_url":"https://github.com/mainakae","followers_url":"https://api.github.com/users/mainakae/followers","following_url":"https://api.github.com/users/mainakae/following{/other_user}","gists_url":"https://api.github.com/users/mainakae/gists{/gist_id}","starred_url":"https://api.github.com/users/mainakae/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mainakae/subscriptions","organizations_url":"https://api.github.com/users/mainakae/orgs","repos_url":"https://api.github.com/users/mainakae/repos","events_url":"https://api.github.com/users/mainakae/events{/privacy}","received_events_url":"https://api.github.com/users/mainakae/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-17T09:50:26Z","updated_at":"2015-05-17T09:50:26Z","closed_at":null,"body":"Hello all and congratulations for this awesome library!.\r\n\r\nI've been experiencing some issues passing custom CA certificates to request. I followed the documentation, setting `agentOptions.ca` successfully in an non-proxy environment, but then I moved the code to a proxied one (proxy configured via `$http_proxy`), and found that it didn't work any more. Te error that returned the previously working code was that it couldn't verify the CA. After some debugging and code inspection I've summed-up the following: \r\n\r\n1. using `options.agentOptions.ca`, which is the way stated in the documentation, will work in a non-proxied env, but not in a proxied one.\r\n2. using `https.globalAgent.options.ca`, which is not documented, but is stated in many places (stackoverflow, forums...) as a feasible way of setting it, will work on non-proxied but won't in proxied again.\r\n3. using `options.ca`, which is not documented (I had to find it inspecting code and later in some issue comments in github) WORKS IN BOTH, non-proxied and proxied environments.\r\n\r\nThe problem lies in this piece of code (or so I think)\r\n\r\n```javascript\r\nfunction constructTunnelOptions(request) {\r\n  var proxy = request.proxy\r\n\r\n  var tunnelOptions = {\r\n    proxy : {\r\n      host      : proxy.hostname,\r\n      port      : +proxy.port,\r\n      proxyAuth : proxy.auth,\r\n      headers   : request.proxyHeaders\r\n    },\r\n    headers            : request.headers,\r\n    ca                 : request.ca,\r\n    cert               : request.cert,\r\n    key                : request.key,\r\n    passphrase         : request.passphrase,\r\n    pfx                : request.pfx,\r\n    ciphers            : request.ciphers,\r\n    rejectUnauthorized : request.rejectUnauthorized,\r\n    secureOptions      : request.secureOptions,\r\n    secureProtocol     : request.secureProtocol\r\n  }\r\n\r\n  return tunnelOptions\r\n}\r\n```\r\n\r\nIn order to account for other possibles sources of CA information, this code should become something like:\r\n\r\n```javascript\r\nvar tunnelOptions = {\r\n//...\r\n    ca                 : request.ca ||  agentOptions.ca || https.globalAgent.options.ca\r\n//...\r\n}\r\n```\r\n\r\nThis should take the right order of priority for CAs (request > agentOptions > globalAgent). There's a problem, though: `agentOptions` is not accessible from `constructTunnelOptions`. Other alternative could be to use `request.agent` (`agentOptions` are used to construct that `.agent`) but then again, `request.agent` is constructed way after `constructTunnelOptions` is called, thus no luck there neither.\r\n\r\nOne point worth to be discussed, then, is if it's \"sane\" or semantically correct to set the CA in `agentOptions`while in a proxied environment, as there's going to be no agent involved in the communication (it instead uses a tunneled TLS connection), and that's tat. But I also find that, as request tries (and **THANK YOU FOR THAT**) to hide the proxy configuration from the developer, it should maintain coherence in the settings among proxied and non-proxied environments.\r\n\r\n**CONCLUSION:** I think the best way to solve this issue is also the simplest: document `options.ca` as the right way of setting the CAs for request, as `agentOptions.ca` would leave uncovered proxied environments (as it has to be!). Then, if something breaks, try to fix it. But PLEASE document `options.ca` now, as not doing so *is a defect in itself*.\r\n\r\nI've found that this lack of documentation is related to a number of other issues (#1490, #1290, #1229, #1236) and even pull-request that didn't make it to master (#1289) but fixed this issue.\r\n\r\n "}}