Client network socket disconnected before secure TLS connection was established

[brandonregard]

Current Behavior

Setting https proxy to https://172.20.7.148:9090
recoverIdToken error: TimeoutError: Client network socket disconnected before secure TLS connection was established

Works without "addProxyToClient".

Expected Behavior

Traffic is proxied through Proxyman.

Steps to Reproduce the Problem

import { addProxyToClient } from 'aws-sdk-v3-proxy';

...

const cognitoIdpCient: CognitoIdentityProviderClient = addProxyToClient(
  new CognitoIdentityProviderClient({
    region: REGION,
  }),
  {
    debug: true,
  }
);

...

const forgotPasswordCommand: ForgotPasswordCommand = new ForgotPasswordCommand({
      ClientId: CLIENT_ID,
      Username: PHONE,
});
forgotPasswordResponse = await cognitoIdpCient.send(forgotPasswordCommand);

Environment

• Version: 2.0.14
• Platform: Mac/Linux
• Node.js Version: v18.16.0

[brandonregard]

When Proxman is not listening the error is Error: connect ECONNREFUSED. So, appears to be there.
Cert issue? It is installed on the system.

Also tried:

const certs = [readFileSync('/Users/brandon/Desktop/proxyman.pem')];
const agent = new HttpsProxyAgent('https://172.20.7.148:9090', {
  rejectUnauthorized: false,
  ca: certs,
});
const cognitoIdpCient: CognitoIdentityProviderClient = new CognitoIdentityProviderClient({
  region: REGION,
  requestHandler: new NodeHttpHandler({
    httpsAgent: agent,
  }),
});

from: https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-registering-certs.html

Same error: "Client network socket disconnected before secure TLS connection was established"

[ryansonshine]

Thanks for the bug report @brandonregard.

Is this code running on your local machine or on AWS Lambda?

Also, does this happen on every attempt or just occasionally?

[brandonregard]

Thanks for the bug report @brandonregard.

Is this code running on your local machine or on AWS Lambda?

Also, does this happen on every attempt or just occasionally?

On local machines and happens every time.

[ryansonshine]

Hi @brandonregard ,

I have a feature I'll be releasing shortly that will allow you to specify additional options including specifying the ca for requests. In the interim, can you try running your process using the NODE_EXTRA_CA_CERTS environment variable?

It needs to be set prior to starting up the process (i.e. you can't do process.env.NODE_EXTRA_CA_CERTS in your code).

NODE_EXTRA_CA_CERTS="/Users/brandon/Desktop/proxyman.pem"

import { addProxyToClient } from 'aws-sdk-v3-proxy';

...

const cognitoIdpCient: CognitoIdentityProviderClient = addProxyToClient(
  new CognitoIdentityProviderClient({
    region: REGION,
  }),
  {
    debug: true,
  }
);

...

const forgotPasswordCommand: ForgotPasswordCommand = new ForgotPasswordCommand({
      ClientId: CLIENT_ID,
      Username: PHONE,
});
forgotPasswordResponse = await cognitoIdpCient.send(forgotPasswordCommand);

[github-actions]

🎉 This issue has been resolved in version 2.1.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[ryansonshine]

The latest version now supports additional agent options.

@brandonregard try updating to the latest version and executing the following:

import { addProxyToClient } from 'aws-sdk-v3-proxy';

...
const certs = [readFileSync('/Users/brandon/Desktop/proxyman.pem').toString()];
const cognitoIdpCient: CognitoIdentityProviderClient = addProxyToClient(
  new CognitoIdentityProviderClient({
    region: REGION,
  }),
  {
    debug: true,
    agentOptions: {
      rejectUnauthorized: true,
      ca: certs,
    }
  }
);

...

const forgotPasswordCommand: ForgotPasswordCommand = new ForgotPasswordCommand({
      ClientId: CLIENT_ID,
      Username: PHONE,
});
forgotPasswordResponse = await cognitoIdpCient.send(forgotPasswordCommand);

Let me know if you run into any additional issues, thanks!