@cloudflare/vite-plugin dev: workerd outbound TLS ignores system CA store on NixOS

[QexleOSS]

What versions & operating system are you using?

System:
OS: Linux 7.1 cpe:/o:nixos:nixos:26.11 26.11 (Zokor)
CPU: (4) x64 Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Memory: 4.73 GB / 15.54 GB
Shell: 5.3.15 - /run/current-system/sw/bin/bash
Binaries:
Node: 24.18.1 - /run/current-system/sw/bin/node
bun: 1.3.13 - /run/current-system/sw/bin/bun
npmPackages:
@cloudflare/vite-plugin: 1.52.1
wrangler and miniflare are transitive deps, so they don't show in envinfo. Workerd in node_modules/@cloudflare/workerd-linux-64 reports version 1.20260811.1. Also using @cloudflare/vite-plugin 1.52.1 with Vite 8.2.1 and solid-js 2.0.0-rc.0 with the Solid start middleware.

Please provide a link to a minimal reproduction

Not yet published. Repro setup: any SolidJS/React app using @cloudflare/vite-plugin with viteEnvironment: { name: "ssr" }, a Hyperdrive local connection string, and a route that queries a Postgres database whose TLS cert is chained to a 2026 Let's Encrypt root (leaf -> YR1 -> Root YR -> ISRG Root X1). On NixOS, load the homepage. I can push a minimal reproduction on request.

Describe the Bug

Running bun run dev on NixOS with the Cloudflare Vite plugin floods stdout with TLS errors on every request that reaches a service connecting out over TLS. Each homepage load fired the error roughly 10 times (the DB client pool maxes at 10 connections):

e = kj/compat/tls.c++:269: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate

Steps:

1. Create an app with @cloudflare/vite-plugin, ssr vite environment, and a service that connects to a remote TLS endpoint with a 2026 Let's Encrypt certificate.
2. bun run dev.
3. Load a page that triggers outbound TLS.

Actual: outbound TLS fails with the error above. The service endpoint is unreachable.

Expected: outbound TLS trusts certs issued by the new Let's Encrypt roots.

The server cert itself is valid. curl trusts the chain, Node's fetch succeeds, and OpenSSL validates leaf -> YR1 -> Root YR -> ISRG Root X1. Only workerd fails, so it is not reading the system trust store. wrangler dev wires workerd to the system store; the Vite plugin's dev path does not, so workerd falls back to its built-in bundle.

Workaround that fixes it:

NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt bun run dev

Workerd and miniflare honor NODE_EXTRA_CA_CERTS. With it set, the errors stop and the DB connection succeeds.

Related: #8158 reports the same error with @astrojs/cloudflare. miniflare#587 passes NODE_EXTRA_CA_CERTS through as trusted certs, workerd#3500 recommends the same variable, and workerd#4020 documents that nodejs_compat tls ignores the ca option.

Please provide any relevant error logs

2026-08-16T… workerd/utilities.c++:…: exception: (wdErrId=…) kj/compat/tls.c++:269: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate
(copy one full stack block from your paste, the frames are all identical aside from wdErrId)

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #15229

Summary

The @cloudflare/vite-plugin dev server does not forward the system CA trust store to the embedded workerd/miniflare instance (unlike wrangler dev), so outbound TLS to endpoints using the new 2026 Let's Encrypt roots fails with "unable to get local issuer certificate".

Classification

• Type: Bug
• Component: packages/vite-plugin-cloudflare (with packages/miniflare integration)
• Severity: Medium
• Has Reproduction: No published link (detailed steps provided; reporter offered a minimal repro on request — and an automated triage bot independently reproduced it)
• Quality: Complete

Findings

• Created: 2026-08-16
• Author: QexleOSS
• Version: @cloudflare/vite-plugin 1.52.1, workerd 1.20260811.1, Vite 8.2.1, Node 24.18.1 (all current)
• Labels: none
• Comments: 2 (both automated bots: workers-devprod)

Analysis

• Component clearly identified. The reporter isolated the bug to the Vite plugin's dev path, noting that wrangler dev wires workerd to the system trust store while the Vite plugin does not, causing workerd to fall back to its built-in CA bundle. Points squarely at packages/vite-plugin-cloudflare and its miniflare integration.
• Reproduction confirmed. An automated triage bot (comment #5309679922) reports it successfully reproduced the failure — simulating an inaccessible CA store with SSL_CERT_FILE=/nonexistent SSL_CERT_DIR=/nonexistent, a minimal vite-plugin app fails outbound TLS with the exact reported error (kj/compat/tls.c++:269 unable to get local issuer certificate), and NODE_EXTRA_CA_CERTS fixes it. This removes the usual "needs reproduction" blocker.
• Working workaround provided. NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt bun run dev resolves it, corroborating the root-cause theory that the plugin isn't passing through system CAs.
• Good cross-referenced prior art. Cites 🐛 BUG: **kj::Compat/tls TLS certificate is not trusted when running wrangler dev in Docker** #8158 (same error via @astrojs/cloudflare), miniflare#587 (passes NODE_EXTRA_CA_CERTS through as trusted certs), workerd#3500 (recommends the same var), and workerd#4020 (nodejs_compat tls ignores the ca option).
• Severity reasoning. Not a crash or data loss, but it makes outbound TLS services (e.g. Postgres over a Hyperdrive local connection string) unreachable in dev on affected systems, and floods stdout. Medium.

Recommendation

Status: KEEP OPEN

Reasoning: This is a well-scoped, actionable bug with a diagnosed root cause, a confirmed reproduction, a working workaround, and relevant cross-references. The Vite plugin's dev path should forward the system CA store (or NODE_EXTRA_CA_CERTS) to the embedded workerd/miniflare instance the way wrangler dev does.

Action: Route to the Vite plugin maintainers to align the dev-path CA handling with wrangler dev — ensure the system CA store / NODE_EXTRA_CA_CERTS is forwarded to the embedded miniflare/workerd instance. A repro has already been confirmed by automation, so this can go straight to implementation; the reporter's offered minimal repo can still be requested if useful for verification.

Suggested Labels: none (apply only labels that already exist in the repo, at maintainer discretion — likely candidates would be a vite-plugin package label and a bug label if they exist)

Suggested Comment

Thanks for the detailed report and for pinpointing the difference between wrangler dev and the Vite plugin's dev path — that's really helpful, and we were able to reproduce the failure on our end. It does look like the Vite plugin isn't forwarding the system CA store (or NODE_EXTRA_CA_CERTS) to the embedded workerd/miniflare instance the way wrangler dev does, so we'll look at aligning that behavior. In the meantime, NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt is a solid workaround, as you noted. If it's easy to push that minimal reproduction you mentioned, that'd help us verify the fix, but it isn't blocking — we'll follow up here.

Structured summary (JSON)

{
  "issueNumber": 15229,
  "title": "@cloudflare/vite-plugin dev: workerd outbound TLS ignores system CA store on NixOS",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/15229",
  "recommendation": "KEEP OPEN",
  "difficulty": "medium",
  "reasoning": "Well-scoped, confirmed-reproduced bug: the Vite plugin dev path does not forward the system CA store to workerd/miniflare like wrangler dev does, breaking outbound TLS to 2026 Let's Encrypt roots. A working NODE_EXTRA_CA_CERTS workaround and relevant cross-references make it actionable.",
  "suggestedAction": "Route to Vite plugin maintainers to align dev-path CA handling with wrangler dev (forward system CA store / NODE_EXTRA_CA_CERTS to embedded miniflare/workerd). Reproduction already confirmed by automation.",
  "hasSuggestedComment": true,
  "suggestedLabels": []
}

[workers-devprod]

• Reproduction: ✅ Successfully reproduced. Simulated NixOS-like inaccessible CA store with SSL_CERT_FILE=/nonexistent SSL_CERT_DIR=/nonexistent. Minimal vite-plugin app fails outbound TLS with exact reported error: kj/compat/tls.c++:269 unable to get local issuer certificate. NODE_EXTRA_CA_CERTS workaround fixes it.