Self signed certificate errors with vscode-insiders 1.36.0

[skamens]

I'm using Remote Containers with vscode-insiders. Everything was working swimmingly until my version automatically got upgraded to 1.36.0.

Now when I try to rebuild my container I'm getting this error:

Run: docker exec bfd96d16537e595543020b5d3a1169800fb55c5040968a7203140885986762b1 mkdir -p /root/.vscode-server-insiders/bin/7a5bca9fafbbb23de289179be95e9c4832540c02_1559855096930
Error: self signed certificate in certificate chain
at TLSSocket.onConnectSecure (_tls_wrap.js:1049:34)
at TLSSocket.emit (events.js:182:13)
at TLSSocket._finishInit (_tls_wrap.js:631:8)

I have http.proxyStrictSSL set to false in my settings, but that doesn't seem to help.

Can anybody see what's wrong with this?

[skamens]

BTW - if there's any way to revert to a prior version so I can see verify that it still works there, I'd be happy to do that; I just couldn't find a way to download the prior version of insiders

[larsw]

I'm experiencing the same issue. I'm behind an inspecting firewall, and have created an base docker image that adds the additional trust anchors (ca-certs), but I still get this error.

[zerdos]

vscode uses a different node (shipped with vscode itself) to run the extensions, and the execution context is different. If you use npm config, that will be ineffective, also if you set the ca file location in the environment variables, it wont read the file.

[skamens]

Update - now that the stable version (1.35.0) supports Remote Containers, I was able to test this with 1.35 and found that it works properly.

So 1.36.0 has introduced behavior that breaks something that works in 1.35.0. I'd really love to see this fixed before 1.36.0 becomes stable and it stops working again.

[chrmarti]

@skamens The connection you see not working is only needed once per VS Code version for downloading the server bits. 1.35.0 might have downloaded these before while 1.36.0 still needs to do so. So it's not necessarily something that broke between these two versions.

I have checked our code and it still loads the certificates in the latest version. Can you double-check the certificate is still registered in the OS?

[skamens]

This is an issue with a proxy that uses a self-signed certificate. Nothing has changed in my network or system configuration, but I was still able to get vscode to honor the "no strict SSL" option with 1.35, and I am not able to do the same with 1.36.

I'm happy to go with a workaround such that I can download the files manually or something, but mine is not the only circumstance where self-signed certs are used.

[chrmarti]

Still not sure what has changed between 1.35 and 1.36. What are your settings in 1.35 vs. 1.36?

[skamens]

I have lots and lots of settings....

Which particular ones would you like to know about?

[chrmarti]

"http.proxy", "http.proxyAuthorization", "http.proxyStrictSSL", "http.proxySupport" and "http.systemCertificates".

Are you setting HTTP_PROXY or HTTPS_PROXY environment variables?

[skamens]

All of the settings indicated are the same between 1.35 and 1.36.

I set HTTP_PROXY and HTTPS_PROXY inside my container via the Dockerfile.

From looking at the output from the build of the container in each program, I see that the 1.35 version does this:

Run: docker cp C:\Users\KAMENS~1\AppData\Local\Temp\vsch\553cfb2c2205db5f15f3ee8395bbd5cf066d357d\vscode-server-linux-x64.tar.gz 4ea79812d2f27e85d67b0b7f75686c43a6dcde2d20ee6e94cee26e1a295350de:/root/.vscode-server/bin/553cfb2c2205db5f15f3ee8395bbd5cf066d357d_1560523030428
..Run: docker exec -w /root/.vscode-server/bin/553cfb2c2205db5f15f3ee8395bbd5cf066d357d_1560523030428 4ea79812d2f27e85d67b0b7f75686c43a6dcde2d20ee6e94cee26e1a295350de tar --no-same-owner -xf vscode-server-linux-x64.tar.gz --strip-components 1

Which tells me that it already has the file locally, while with the 1.36 version I see this:

Run: docker exec bfd96d16537e595543020b5d3a1169800fb55c5040968a7203140885986762b1 test -d /root/.vscode-server-insiders/bin/d04b5d2eb16c156e24dbf44010c315d968694bd6
Installing VS Code Server for commit d04b5d2eb16c156e24dbf44010c315d968694bd6
Run: docker exec bfd96d16537e595543020b5d3a1169800fb55c5040968a7203140885986762b1 mkdir -p /root/.vscode-server-insiders/bin/d04b5d2eb16c156e24dbf44010c315d968694bd6_1560523302289
Error: self signed certificate in certificate chain
        at TLSSocket.onConnectSecure (_tls_wrap.js:1049:34)
        at TLSSocket.emit (events.js:182:13)
        at TLSSocket._finishInit (_tls_wrap.js:631:8)

So it's not clear to me what it's actually doing there (a mkdir shouldn't cause an error like this). I presume that means it is trying to retrieve the vscode-server-linux tar.gz file outside of the container before pushing it in there.

[chrmarti]

It downloads the server after mkdir succeeded. Does 1.35 still work when you first move C:\Users\KAMENS~1\AppData\Local\Temp\vsch\553cfb2c2205db5f15f3ee8395bbd5cf066d357d\vscode-server-linux-x64.tar.gz somewhere else?

[vscodebot]

This issue has been closed automatically because it needs more information and has not had recent activity. See also our issue reporting guidelines.

Happy Coding!