Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Opening Cloud Shells fails with "Error: Error: unable to verify the first certificate" #394

Closed
dozer75 opened this issue Jan 1, 2022 · 35 comments
Closed

Opening Cloud Shells fails with "Error: Error: unable to verify the first certificate" #394

dozer75 opened this issue Jan 1, 2022 · 35 comments

Comments

@dozer75
Copy link

dozer75 commented Jan 1, 2022

Today, when I am trying to open a Cloud Shell (both PowerShell and Bash) I can't get it to work. This worked without any issues yesterday and it is working to day when doing it outside of Visual Studio Code (using Windows Terminal), so I suspect that it may be some issues with a new year, and some root certificates that has expired for this extension that does it?

Steps to reproduce:

  1. Ensure that you have a valid cloud shell on your azure account
  2. Log in using the Azure: Sign in command
  3. Try to open either a PowerShell or Bash Cloud Shell using the Azure: Open <shell> in Cloud Shell

Expected result:
A cloud shell is opened in the terminal list

Actual result:
The error below is displayed

Requesting a Cloud Shell...
Connecting terminal...
Error: Error: unable to verify the first certificate

Environment:

Operating system: Windows 11 Pro OS Build 22000.376

Visual Studio Code: 1.63.2 899d46d82c4c95423fb7e10e68eba52050e30ba3 x64

Azure Account: 0.9.11
@dozer75
Copy link
Author

dozer75 commented Jan 2, 2022

Deleted an old comment.. For some reason it did work after a short while yesterday.. And it worked today but suddenly it just stopped working with the same error. It can't be related to new year then (just a coincidence that I got this then), but something else...

@1lomeno3
Copy link

1lomeno3 commented Jan 5, 2022

I need to report the same issue, tried with several tenants, some are working, some not, no clue what is the root cause.

@wwlorey
Copy link
Contributor

wwlorey commented Jan 5, 2022

Thanks for reporting @dozer75 and @1lomeno3. This is a strange issue that I have seen myself. Unfortunately we can't do much to mitigate it in the extension because it's a transient issue on the Azure backend side. Since we've seen multiple reports of this I'll escalate it to the Azure Cloud Shell team.

Also, this tends to fix itself after refreshing VS Code or after just waiting for a bit. Please let us know if you run into any more issues.

Closing as duplicate of #29.

@wwlorey wwlorey closed this as completed Jan 5, 2022
@dsajanice
Copy link

@dozer75 @1lomeno3 I work on the CloudShell team and can investigate this issue. Would you be able to send me your tenant ID via email jadsa@microsoft.com. Thanks.

@dozer75
Copy link
Author

dozer75 commented Jan 21, 2022

@dsajanice You should have an email with my tenant id now.

@1lomeno3
Copy link

@dsajanice for me it suddenly started to work, both PS and bash options...

@marco-svitol
Copy link

I use it quite often and 20% of the time is giving me the same error.
Restarting VS Code and even Windows doesn't help.
Looks like it brokes when the previous connection is closed for inutilization.
It always needs some hours to start working again.

@dsajanice
Copy link

Thank you for reporting @marco-svitol. Could you also please send me your tenant ID via email at jadsa@microsoft.com. Since this occurred more recently, the backend logs will be helpful.

@ITpro1984
Copy link

I am getting the same exact error.

My environment:

Visual Studio
Windows 10

I am launching the Bash (Azure CLI) via Visual studio code. It was working most of the day.

Requesting a Cloud Shell...
Connecting terminal...
Error: Error: unable to verify the first certificate

@ITpro1984
Copy link

It worked approximately after 2 hrs. :-(

@dsajanice
Copy link

Thank you for reporting and following up with tenant IDs. I believe we have identified the root cause. We will test the fix and keep this thread posted on rollout timelines.

@marco-svitol
Copy link

marco-svitol commented Feb 9, 2022 via email

@wwlorey wwlorey mentioned this issue Feb 14, 2022
Closed
@nicdjb
Copy link

nicdjb commented Feb 18, 2022

So have I got this right, as an engineer I am meant to wait several hours and try again until this eventually works?
Looks like we have to find an alternate method for managing deployments.
Thanks

@SamuelSMendesS
Copy link

SamuelSMendesS commented Mar 9, 2022 •
edited

Once I reinstalled the Azure CLI extension the error of "unable to verify the first certificate" stopped showing up. I'm new in the business so I can't really point that as a solution. But I wanted to share here so maybe someone with more expertise could look into it.

@ashdhalama
Copy link

Thank you for reporting @marco-svitol. Could you also please send me your tenant ID via email at jadsa@microsoft.com. Since this occurred more recently, the backend logs will be helpful.

I am also getting the same error when try and open Cloud shells via vscode.

@albert-kevin
Copy link

got the same issues, reinstalled everything, strange...

@parallelo
Copy link

I'm seeing these errors too.

Signing in...
Requesting a Cloud Shell...
Connecting terminal...
Error: unable to verify the first certificate

I tried re-installing, but there was no change. I also tried other versions of the Azure Account extension, then did the required reloads; however, the same error always occurs.

@Jd33ks
Copy link

Jd33ks commented Mar 24, 2022

I am also stuck with this - it's been driving me mad.

@GrumpyRainbow GrumpyRainbow mentioned this issue Mar 24, 2022
Open
@ddrummelsmith
Copy link

I keep getting this error too. I've traced it through the logs in VScode. for me the source error is related to MFA

""error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access"

however I'm unable to get VScode to prompt for the MFA request. I've uninstalled and reinstalled VS code. all authentication apps. And tried signing in via the authentication prompts with in VS code.

image

If anyone has any tips on how to get signed in with vscode and MFA it would be appreciated. I really can't disable MFA on my account just for this.

@dsajanice
Copy link

Apologies folks for the delay in rolling out a fix. I acknowledge that this is not a good experience. We are running behind schedule on providing a robust fix. I will commit to providing an update on a fix or a workaround by the end of April.

@cymylau
Copy link

cymylau commented Mar 29, 2022

Just here to say I have the same issue, trying to evaluate remote cloud shell but unable to do so due to same error message. Apricate any help / work arounds in the mean time.

@jasweaver
Copy link

Just found this, and glad I did. This has been driving me in circles for a week.... uninstall, reinstall, etc., etc. does nothing to fix the issue. Please let us know as soon as you have it working again.

@harryvu
Copy link

harryvu commented Mar 30, 2022

Got the exact same error. Please fix this and provide any suggestion to work around this. Thanks.

@dsajanice
Copy link

dsajanice commented Mar 30, 2022 •
edited

Could someone please try the following and let me know if it resolves the issue. Could you please install all the associated intermediate certificates that are listed here: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/certificate-authorities#associated-intermediate-cas

The reason for this is we recently found an issue in the certificate chain that Cloud Shell was using to establish a TLS session with the client browser. We know that installing the intermediate certificate manually has worked as a mitigation for that issue. If this VS Code issue is resulting from the same root cause, then installing the intermediate certificate manually should work. This is only a workaround and not a final fix. Thank you for your patience.

@wwlorey
Copy link
Contributor

wwlorey commented Mar 30, 2022

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/certificate-authorities#associated-intermediate-cas

@dsajanice I installed these four certificates to the system keychain on my M1 Mac and got this error: UNABLE_TO_VERIFY_LEAF_SIGNATURE

Screen Shot 2022-03-30 at 2 50 23 PM

@cymylau
Copy link

cymylau commented Mar 30, 2022 •
edited

Edited Reply.

From the supplied link, I've downloaded the certs I thought I needed, exported as base64 and created a single file "certbundle.pem".

Updated settings.json file to include this cert bundle using

{
    "http.systemCertificates": true,
    "http.proxySupport": "off",
    "editor.inlineSuggest.enabled": true,
    "NODE_EXTRA_CA_CERTS": "C:/Users/richj/OneDrive/Desktop/certbundle.pem",
}

Now getting same as wwlorey - UNABLE_TO_VERIFY_LEAF_SIGNATURE.

@bartvermeersch bartvermeersch mentioned this issue Mar 31, 2022
Closed
@dsajanice
Copy link

Cloud Shell rolled out a cert related update today. We believe it should address this problem. Please retry and confirm. Thanks!

@wwlorey
Copy link
Contributor

wwlorey commented Mar 31, 2022

It's working for me. Thanks for the work on this, @dsajanice!

@smt1821
Copy link

smt1821 commented Apr 1, 2022

It works for me as well. Thanks for that.

@Jd33ks
Copy link

Jd33ks commented Apr 1, 2022 via email

@albert-kevin
Copy link

It works for me as well now too. Thank you !

@ddrummelsmith
Copy link

First couple of tests for me are working.

Thank you.

@wafzal714
Copy link

Works for me as well, thank you!

@jasweaver
Copy link

I also confirmed it is working for now; both Bash and PWSH; on MAC OSx

@cymylau
Copy link

cymylau commented Apr 1, 2022

Also working, thanks!

@dsajanice dsajanice mentioned this issue Apr 1, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests