Outgoing https calls incorrectly resolving to localhost ECONNREFUSED 127.0.0.1:443

[jamesacres]

Using node v12.18.2 and v14.16.0
Version 3.2.0 is unaffected
Version 3.3.3 is affected on mac and linux, but seems okay on windows.

All https calls are resolving to localhost resulting in
connect ECONNREFUSED 127.0.0.1:443

The xray trace itself has the right host set, but can also see the incorrect localhost

Spotted whilst using the sns-validator module https://github.com/aws/aws-js-sns-message-validator/blob/master/index.js#L106
https = require('https'),
https.get(certUrl

Fails with connect ECONNREFUSED 127.0.0.1:443

Where certUrl is a string like "https://sns.eu-west-2.amazonaws.com/SimpleNotificationService-xxxx.pem"

Looks semi-related to the following issue:
#240

[willarmiros]

Thanks for raising this @jamesacres. Could you provide the complete trace data for the trace included in your screenshot, so we can see where the localhost is coming from? Also, some more detailed repro code (e.g. using the getCertificate API) so that I can create the trace myself and attempt to fix this?

[jamesacres]

I can't send the whole trace with sensitive info but here is an interesting subset

 "subsegments": [
                    {
                        "id": "7790b45a90f99854",
                        "name": "sns.eu-west-2.amazonaws.com",
                        "start_time": 1623164413.186,
                        "end_time": 1623164413.187,
                        "fault": true,
                        "http": {
                            "request": {
                                "url": "https://localhost/",
                                "method": "GET"
                            }
                        },
                        "namespace": "remote",
                        "cause": {
                            "working_directory": "/usr/src/app",
                            "exceptions": [
                                {
                                    "message": "connect ECONNREFUSED 127.0.0.1:443",
                                    "type": "Error",
                                    "remote": false,
                                    "stack": [
                                        {
                                            "path": "net.js",
                                            "line": 1141,
                                            "label": "TCPConnectWrap.afterConnect [as oncomplete]"
                                        }
                                    ]
                                }
                            ]
                        }
                    }
                ]

[jamesacres]

Here is a simple working script which calls the right url and says signature invalid.

Our validator in express does not call the right url with the latest xray installed and configured.

import MessageValidator from 'sns-validator';

const message = `{
  "Type": "Notification",
  "MessageId": "xxx",
  "TopicArn": "arn:aws:sns:us-west-2:123:MyTopic",
  "Subject": "xxxx",
  "Message": "{}",
  "Timestamp": "2012-04-26T20:45:04.751Z",
  "SignatureVersion": "1",
  "Signature": "EXAMPLE",
  "SigningCertURL": "https://sns.eu-west-2.amazonaws.com/SimpleNotificationService-xxx.pem"
}`;

// Verify SNS signature, this will make a call to SigningCertURL in the request
const validator = new MessageValidator();
new Promise((resolve) => {
  validator.validate(message, (err) => {
    if (err) {
      // Your message could not be validated.
      console.warn(err.message, err.stack);
      return resolve(false);
    }

    // message has been validated and its signature checked.
    return resolve(true);
  });
});