Storage explorer not finding tenant: SELF_SIGNED_CERT_IN_CHAIN

[bplaats]

Storage Explorer Version:
Platform/OS Version:win7
Architecture:
Regression From:

Steps to Reproduce:

1. login to storage explorer
2. storage explorer authenticates authenticates successfully but no tenant/subscription or errors on retreivel

Expected Experience:

expect storage listing for subscription

Actual Experience:

Received this error and told to report here to github

Subscriptions for the follwowing tenants could not be retrieved:
Tenant Id: 539e8ab5-5bfa-44c8-b872-3dc8d1a124f8, Error: {"code":"SELF_SIGNED_CERT_IN_CHAIN"}

[PeterParker1234]

This is a serious issue which deserves attention

[x3nc0n]

I am also having this issue and have a Premiere case open on it.

[x3nc0n]

Subscriptions for the follwowing tenants could not be retrieved:
Tenant Id: , Error: {"code":"SELF_SIGNED_CERT_IN_CHAIN"}

I have imported my PKI certs, as we do TLS inspection, but still get this error.

[MRayermannMSFT]

Could y'all trying launching Storage Explorer from the command line, and when doing so, include a --ignore-certificate-errors flag. So for example:

.\StorageExplorer.exe --ignore-certificate-errors

And let me know if that helps you out.

[x3nc0n]

It works when I do that. Is there somewhere I can view the self-signed cert it's getting? I have imported my entire PKI and firewall certificate chains (we do inspection on the firewall, off a CA cert issued by one of my two Enterprise CAs, which are signed by the offline root.

[x3nc0n]

From Dev Tools errors:

self_cert_azurestorage.txt.txt

[MRayermannMSFT]

Unfortunately we don't know of a way to see the untrusted cert (and it has frustrated the heck out of us as well). I've been asking around Microsoft/the Electron community for help on this issue, and so far people have advised that we use the Electron Net module. Thing is, we can't do that right now because the Azure Storage library doesn't provide a way for us to change how they do network requests. So although we would get your sign in and subscriptions unblocked, you wouldn't be able to actually interact with Storage.

We're hoping that in the future it will be possible to change how the library makes requests, but until then, you either have to get lucky in finding the certs or use the flag (which is potentially unsafe, but I'll leave taking that risk up to you). Please let us know if you find a reliable way to discover the certs though, as we would love to share that method with other users!

And to clarify, you are saying the flag works yes?

[x3nc0n]

Yes, it does.

[x3nc0n]

Is there any list of URIs that are used to get that subscription data? I can add those to my inspection bypass list and see if that helps.

[MRayermannMSFT]

Here are the URLs that we talk to for getting subscriptions:

• Azure: https://management.azure.com/
• Azure Germany: https://management.microsoftazure.de/
• Azure US Govt: https://management.usgovcloudapi.net/
• Azure China: https://management.chinacloudapi.cn/

[MRayermannMSFT]

If adding those to your inspection by pass fixes the issue, then we can work on getting you the other URLs we talk to.