internel-ssl broken after upgrade to 5.0.0-beta.1

[Jefffrey]

Bug description

When running configurable-http-proxy 5.0.0-beta.1 with Jupyterhub where internal ssl config is enabled, unable to query the proxy correctly, getting error:

• In proxy, error: ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED
• In Jupyterhub, error: PEER_DID_NOT_RETURN_A_CERTIFICATE

How to reproduce

Run jupyerhub, then curl the /hub/health endpoint

Expected behaviour

Expect 200

Actual behaviour

Get 503 with above errors in logs

Your personal set up

Running Jupyterhub in docker container

• OS:

• Version(s): Python 3.11, Jupyterhub 4.1.6

Full environment

# paste output of `pip freeze` or `conda list` here

Configuration

# jupyterhub_config.py
import socket

JupyterHub.proxy_class = 'jupyterhub.proxy.ConfigurableHTTPProxy'
JupyterHub.internal_ssl = True
JupyterHub.internal_certs_location = 'internal-ssl'
JupyterHub.trusted_alt_names = ['IP:' + socket.gethostbyname(socket.gethostname())]

Logs

[Jefffrey]

I suspect it's due to this PR #572

Specifically, this change:

configurable-http-proxy/lib/configproxy.js

Lines 559 to 565 in 6514a2b

	target = new URL(target);
	var proxyOptions = { target: target };
	if (that.options.clientSsl) {
	proxyOptions.key = that.options.clientSsl.key;
	proxyOptions.cert = that.options.clientSsl.cert;
	proxyOptions.ca = that.options.clientSsl.ca;
	}

If I manually overwrite the nodejs file and revert it to this code, it works:

configurable-http-proxy/lib/configproxy.js

Lines 559 to 567 in 0edbf7c

	target = URL.parse(target);
	if (that.options.clientSsl) {
	target.key = that.options.clientSsl.key;
	target.cert = that.options.clientSsl.cert;
	target.ca = that.options.clientSsl.ca;
	}
	// add config argument
	var proxyOptions = { target: target };

So it seems the ssl options aren't being passed on correctly, hence querying the proxy errors as the proxy doesn't include key+cert+ca details when querying jupyterhub in turn

[minrk]

Thanks for tracking it down! I'll work on a fix and try to add an internal ssl test, which I realize we don't have.

[minrk]

fixed and tested in #584