IAP service account certificate error

[peteole]

Environment details

• OS: MacOs/Google Cloud Functions
• Node.js version: 16
• npm version: 9.5.0
• google-auth-library version: 8.7.0

Steps to reproduce

1. Create an IAP
2. Create a client like here, filling in your values

The idtoken will be fetched without issues. I also verified that the token works by using it in a curl request. However, the client throws the following error:

FetchError: request to https://my-protected-domain.com/mypage failed, reason: unable to verify the first certificate
    at ClientRequest.<anonymous> (/<me>/node_modules/node-fetch/lib/index.js:1491:11)
    at ClientRequest.emit (node:events:513:28)
    at TLSSocket.socketErrorListener (node:_http_client:502:9)
    at TLSSocket.emit (node:events:513:28)
    at emitErrorNT (node:internal/streams/destroy:151:8)
    at emitErrorCloseNT (node:internal/streams/destroy:116:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
  type: 'system',
  errno: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
  code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
...

It is interesting to note that this happens in the nodejs client and the python client, but not in the Golang client. For the python client, setting verify=False in the request solves the issue (in an insecure way).
The service account is verified by a keypair via the GOOGLE_APPLICATION_CREDENTIALS environment variable.
This happens both locally and in a cloud function.

[eshaanmoorjani]

@danielbankhead come back and fix pls i need u rn