sfdx shows SELF_SIGNED_CERT_IN_CHAIN when trying to authorise or list behind ssl intercepting proxy

Question

I asked a previous question, that I resolved, but I am now finding I have another (related) problem.

I have installed git, npm and salesforcedx. I have configured each to work with my companies ssl-intercepting proxy. Git and npm now appear to work fine. My config looks like so for npm (obviously sensitive data removed):

https-proxy=http://usern:pwd@proxyaddress.com:80/
proxy=http://usern:pwd@proxyaddress:80/
cafile="C://Users//usern//ca-bundle.crt"

I have copied and pasted my companies certificate hash into the ca-bundle.crt file referenced here, and it appears to work. I can run the following fine (I don't care what package, just demonstrating I can get through proxy):

npm install normalize.css

However, if I run sfdx force:org:list I get the following error (some data replaced with x chars):

PS C:\code\temp_t> sfdx force:org:list
=== Orgs
ALIAS             USERNAME              ORG ID              CONNECTED STATUS
────────────────  ────────────────────  ──────────────────  ─────────────────────────
xxxxxxxxxxdevhub  xxxxxxxxxx@gmail.com  0xxxxxxxxxxxxxxxxA  SELF_SIGNED_CERT_IN_CHAIN

I also get this error if I try and authorise an org.

This also seems to me like it is the same error I used to get in npm, and is npm complaining about my certificate. However, npm itself doesnt' seem to complain about this unless I comment out the cafile line in my .npmrc. If I do that then I get the following error, which looks like the error in sfdx:

npm ERR! Windows_NT 6.1.7601
npm ERR! argv "C:\\Program Files\\nodejs\\node.exe" "C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npm-cli.js" "ins
tall" "reset.css"
npm ERR! node v6.11.2
npm ERR! npm  v3.10.10
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN

npm ERR! self signed certificate in certificate chain
npm ERR!
npm ERR! If you need help, you may report this error at:
npm ERR!     <https://github.com/npm/npm/issues>

npm ERR! Please include the following file with any support request:
npm ERR!     C:\code\temp_t\npm-debug.log

So from my understanding, sfdx is using my npm install for certificate settings, but is not using the ca-bundle.crt, although it is using the proxy settings from .npmrc? Or is it using my environment variable proxy settings? I have tried adding the line cafile="C:\Users\DEV.BrytonP\ca-bundle.crt" to the .npmrc files located in both of these locations:

C:\Users\usern\.npmrc
C:\Program Files\sfdx\lib\npm\.npmrc

I can also confirm if I use my organisations sslbypass proxy ( that does not have ssl-interception) it works fine. However, company policy will not allow me to use this proxy permanently, so I need to get everything working with the normal proxy.

Is anyone able to shed some light on why I am getting the SELF_SIGNED_CERT_IN_CHAIN in sfdx, when I either try to authorise an org, or try to see the force:org:list, even though it should be using my certicificate which works with git and npm?

Answer 1

The above comment is not true for node v7.3+. Just set NODE_EXTRA_CA_CERTS: https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file

Answer 2

The answer i have identified is that nodejs is most likely the culprit. Nodejs has its own certificates compiled in its source, and does not allow the user to specify a certificate store. In order for this to work from behind an ssl intercepting proxy, the root certificate authority would need to be included in the source code of a custom compiled version of node. Not very practical, but possible.

Answer 3

As mentioned by Jeff Dickey, NODE_EXTRA_CA_CERTS is your best bet since sfdx also uses node and will inherit this as well. There is another option to SKIP_VERIFY, but you should NEVER do this as it opens you up to a whole world of potential issues by allowing connections to other servers for packages that maybe you shouldn't trust.

Many tools automatically use HTTP_PROXY, HTTPS_PROXY, and NO_PROXY if they are defined (ie in your .bashrc or .bash_profile have export HTTP_PROXY='http://user:pass@some.proxy:port) so you don't always need to explicitly configure things in every config file.

See the official Salesforce docs for other things you may need to set: https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_install_cli_firewall.htm