2

I asked a previous question, that I resolved, but I am now finding I have another (related) problem.

I have installed git, npm and salesforcedx. I have configured each to work with my companies ssl-intercepting proxy. Git and npm now appear to work fine. My config looks like so for npm (obviously sensitive data removed):

https-proxy=http://usern:pwd@proxyaddress.com:80/
proxy=http://usern:pwd@proxyaddress:80/
cafile="C://Users//usern//ca-bundle.crt"

I have copied and pasted my companies certificate hash into the ca-bundle.crt file referenced here, and it appears to work. I can run the following fine (I don't care what package, just demonstrating I can get through proxy):

npm install normalize.css

However, if I run sfdx force:org:list I get the following error (some data replaced with x chars):

PS C:\code\temp_t> sfdx force:org:list
=== Orgs
ALIAS             USERNAME              ORG ID              CONNECTED STATUS
────────────────  ────────────────────  ──────────────────  ─────────────────────────
xxxxxxxxxxdevhub  xxxxxxxxxx@gmail.com  0xxxxxxxxxxxxxxxxA  SELF_SIGNED_CERT_IN_CHAIN

I also get this error if I try and authorise an org.

This also seems to me like it is the same error I used to get in npm, and is npm complaining about my certificate. However, npm itself doesnt' seem to complain about this unless I comment out the cafile line in my .npmrc. If I do that then I get the following error, which looks like the error in sfdx:

npm ERR! Windows_NT 6.1.7601
npm ERR! argv "C:\\Program Files\\nodejs\\node.exe" "C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npm-cli.js" "ins
tall" "reset.css"
npm ERR! node v6.11.2
npm ERR! npm  v3.10.10
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN

npm ERR! self signed certificate in certificate chain
npm ERR!
npm ERR! If you need help, you may report this error at:
npm ERR!     <https://github.com/npm/npm/issues>

npm ERR! Please include the following file with any support request:
npm ERR!     C:\code\temp_t\npm-debug.log

So from my understanding, sfdx is using my npm install for certificate settings, but is not using the ca-bundle.crt, although it is using the proxy settings from .npmrc? Or is it using my environment variable proxy settings? I have tried adding the line cafile="C:\Users\DEV.BrytonP\ca-bundle.crt" to the .npmrc files located in both of these locations:

C:\Users\usern\.npmrc
C:\Program Files\sfdx\lib\npm\.npmrc

I can also confirm if I use my organisations sslbypass proxy ( that does not have ssl-interception) it works fine. However, company policy will not allow me to use this proxy permanently, so I need to get everything working with the normal proxy.

Is anyone able to shed some light on why I am getting the SELF_SIGNED_CERT_IN_CHAIN in sfdx, when I either try to authorise an org, or try to see the force:org:list, even though it should be using my certicificate which works with git and npm?

Improve this question
2
  • Most probable cause of that issue is due to https interception by your proxy. Since proxy cannot send targets https cert, it is sending its own. You would have to look at how to add your proxy's certificate as trusted root certificate. Keep in mind, when you do that, proxy can intercept every other https traffic as well. For ex., banking.
    – metasync
    Sep 11, 2017 at 3:39
  • Hi datasert. Thanks for the comment. Yes - it is certainly because of the ssl intercepting proxy that I am getting this error. I have added the root certificate to the ca-bundle.crt (and the .pem file in the sfdx install directory). But it still seems like sfdx does not use it - even though npm itself does.
    – bpilling
    Sep 11, 2017 at 9:58

3 Answers 3

Reset to default
4

The above comment is not true for node v7.3+. Just set NODE_EXTRA_CA_CERTS: https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file

Improve this answer
3

The answer i have identified is that nodejs is most likely the culprit. Nodejs has its own certificates compiled in its source, and does not allow the user to specify a certificate store. In order for this to work from behind an ssl intercepting proxy, the root certificate authority would need to be included in the source code of a custom compiled version of node. Not very practical, but possible.

Improve this answer
1

As mentioned by Jeff Dickey, NODE_EXTRA_CA_CERTS is your best bet since sfdx also uses node and will inherit this as well. There is another option to SKIP_VERIFY, but you should NEVER do this as it opens you up to a whole world of potential issues by allowing connections to other servers for packages that maybe you shouldn't trust.

Many tools automatically use HTTP_PROXY, HTTPS_PROXY, and NO_PROXY if they are defined (ie in your .bashrc or .bash_profile have export HTTP_PROXY='http://user:pass@some.proxy:port) so you don't always need to explicitly configure things in every config file.

See the official Salesforce docs for other things you may need to set: https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_install_cli_firewall.htm

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.