GitLab CI on Windows: "certificate has unknown CA"

[martijnbastiaan]

Not really an issue anymore, but documenting for other people struggling with the same issue.

Issue

stack build fails on Windows using GitLab CI. I'm seeing:

 HttpExceptionRequest Request {
   host                 = "casa.fpcomplete.com"
   port                 = 443
   secure               = True
   requestHeaders       = []
   path                 = "/v1/pull"
   queryString          = ""
   method               = "POST"
   proxy                = Nothing
   rawBody              = False
   redirectCount        = 10
   responseTimeout      = ResponseTimeoutDefault
   requestVersion       = HTTP/1.1
 }
  (InternalException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa))))

The issue is that case.fpcomplete.com uses DST Root CA X3 as a root CA, which Windows - at least the version installed on the CI - does not recognize.

Workaround / solution

1. Open https://casa.fpcomplete.com/ in Firefox
2. Click the 🔒 next to the address, click >, click More information, click View Certificate
3. Open the DST Root CA X3 certificate and download it as a PEM (cert)
4. Add it to your repository
5. On the Windows CI run: certutil –addstore -enterprise –f "Root" path/to/certificate.pem