First of all, I'm not an ESET user or customer. I'm a maintainer of an open-source NodeJS application called SillyTavern.
Yesterday (April 17, 2024) around 16:00 UTC I started receiving reports from users that they couldn't connect to secure hosts through the app, and a GitHub issue was raised. The source of the issue comes from the fact that the users have an incomplete certificate chain on their system, and unlike web browsers that use TLS AIA extension or use their own CA bundle, Node does not automatically complete the certificate chain, which results in an OpenSSL error like the follows (full error log in a linked issue):
Quote
FetchError: request to https://api.cohere.ai/v1/models failed, reason: unable to verify the first certificate
Accessing the affected hosts (an example list below) through a web browser does not result in an error due to the reasons I stated above:
After some investigations with the author of GitHub issues, it was found that it only affects users who are using ESET antivirus products. There are more than 5 affected users so far who reported this either on GitHub or in the Discord community.
- ESET NOD32 17.1.9.0 on Windows 10 (unknown winver)
- ESET Smart Security 17.0.16.0 on Windows 10 22H2
It is important to clarify, that it is not a bug of the specific application as it affects all outgoing connections from other apps that do not implement the TLS AIA extension, here's a minimal reproducible example of a script that results in the same error for the affected users: https://gist.github.com/Cohee1207/10774c05392e1f15f0f5ceac2559e106
The users were also asked to run the following command to connect to an affected host directly by using the OpenSSL client, which resulted in a failed SSL handshake (Verification error: unable to get local issuer certificate):
Quote
openssl s_client -connect api.novelai.net:443
The full output can be found here: https://gist.github.com/Cohee1207/0cf589be525a64e928e3e7260232f8d4
Also, the users confirmed that running Windows in Safe mode, removing ESET products from their system, or adding Node to a list of exceptions for SSL protection seemed to have fixed their issue.
I'm looking forward to your reply.