Support Trust Store certificates of Destination service

An internal user who uses CAP wants to inject the server certificate from S/4HANA which currently fails with following error:

[cds] - Error: Error during request to remote service: self signed certificate

We are clarifying if/how to configure the necessary certificate in CAP or if this is something the SAP Cloud SDK could pick up automatically from the destination.

Link to internal issue: https://github.wdf.sap.corp/cap/issues/issues/9605

[FrankEssenberger]

@gregorwolf

So we started finally working on it and I did some research. I will give here some ideas to provide some more context. If the server uses a self-signed cert the clients will not trust it. In such a case you can:

• Enable trust all -> this is risky and you should not do it. Even in internal or test cases. Man in the middle attacks and somehow dangerous code can end up in produciton
• Include the self-signed CA via NODE_EXTRA_CA_CERTS env variable. The node client will pick it up
• Include the self-signed CA via agent property in your code

We will implement the last one in the SDK and take the value from the destination property TrustStoreLocation. In the first version we will not support jks files like for two way TLS. Only the naitively support formats in node which is pem in this case. However, once done you should be able to use the SDK with self-signed certificates if you add them to the destination.

Best Frank

[FrankEssenberger]

Here also the link to the documentation.