Certificate verification failed (unable to get local issuer certificate) on Windows

[HazyFish]

I'm not able to use the Windows build due to certificate verification issue:

PS D:\> D:\proxytunnel-v1.12.2-x86_64-windows-msys\proxytunnel -E -p example.com:443 -d example.com:22
Via example.com:443 -> example.com:22
Certificate verification failed (unable to get local issuer certificate)

The issue doesn't exist on Ubuntu when I installed via apt

[sge-d-o]

@HazyFish, this is not an issue with proxytunnel but rather a root certificate missing from your Windows system. To learn how to fix this, search the web for 'unable to get local issuer certificate' using your preferred search provider.

[HazyFish]

The root certificate is not missing from Windows. In Windows, root certificates are not stored directly in file system. Proxy tunnel is not able to use the Windows certificate storage mechanism

[sge-d-o]

@HazyFish, according to what I understood from #74 proxytunnel should work in WIndows, though it requires a specific runtime enviroment. @sigio, @FrostKiwi, are you able to help here?

[mcarbonneaux]

the binary are compiled with msys2, and use cygwin openssl, and it search ca trust in /etc/pki/ca-trust/openssl/ca-bundle.trust.crt in the root of msys2...

i think msys2 environment variable cant change the path where they search the ca trust file...

[e9hack]

On windows you must tell proxytunnel the location of your certificates, eg. proxytunnel -C ~/.ssh/certs. The certificates must be stored with hashed names. The hash can be generate with openssl, eg. openssl x509 -hash -noout -in letsencryptauthorityx4.pem. The result is 23c2f850. The certificat must be renamed to 23c2f850.0. If the name does already exist, you have to increment the extension. Instead of a copy you can generate a symlink. The bash ln command under windows generates a copy. For a real symlink you must use mklink.

[FrostKiwi]

On windows you must tell proxytunnel the location of your certificates, eg. proxytunnel -C ~/.ssh/certs. The certificates must be stored with hashed names. The hash can be generate with openssl, eg. openssl x509 -hash -noout -in letsencryptauthorityx4.pem. The result is 23c2f850. The certificat must be renamed to 23c2f850.0. If the name does already exist, you have to increment the extension. Instead of a copy you can generate a symlink. The bash ln command under windows generates a copy. For a real symlink you must use mklink.

Good to know! I'm also getting the same error and was confused by this, always running -z. What a mess with the certs, I'll just ignore the validity (which is a Let's Encrypt cert and 100% correct), since the HTTPS packaging for me is only there to get around packet inspection.

[sge-d-o]

Running openssl rehash <directory> on the directory containing the certificates should be enough to create the hashed name links.