Certificate Checking Switched Off

Why it matters

Disabling certificate checks turns HTTPS into a connection that anyone on the path can read or alter. It is often set once to get past a development hiccup and then ships. The correct fix is to trust the specific certificate, which takes one option.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

const agent = new https.Agent({ rejectUnauthorized: false });

The smallest fix

// Trust the specific CA or self-signed certificate instead of everything:
import https from 'node:https';
import { readFileSync } from 'node:fs';
const agent = new https.Agent({ ca: readFileSync('./certs/internal-ca.pem') });
await fetch(url, { agent });

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

// Or set NODE_EXTRA_CA_CERTS=/path/to/ca.pem in the environment of the
// process, which adds the certificate for every request without code.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Make the request with verification on and confirm it succeeds with
   the CA configured.
2. Point the request at a host with a mismatched certificate and confirm
   it fails.

Further reading

• https://cwe.mitre.org/data/definitions/295.html