Quarto publish connect BadCertificate

[TheisFerre]

Bug description

I am trying to publish quarto-content to a server hosting RStudio Connect. When i run quarto publish connect inst/quarto.qmd --token $API_KEY --server $CONNECT_SERVER i get the following error :

ERROR: TypeError: error sending request for url (<CONNECT_SERVER>/__api__/v1/content): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

However, when I instead do a curl to the same url (curl -H "Authorization: Key $API_KEY" ${CONNECT_SERVER}/__api__/v1/content), I get a valid response with all the contents listings from my RStudio Connect server.

I have checked my certificates from where I run the quarto publish command and I do have a valid certificate for the server running RStudio Connect. Additionally, I am able to use rsconnect-python, to deploy a .qmd file using manifest.

Any idea why Quarto is unable to communicate with my server running RStudio Connect?

VERSIONS:

• Quarto: version 1.1.251
• OS: Red Hat Enterprise Linux Server version 7.9.
• RStudio Connect: v2022.09.0

Checklist

• Please include a minimal, fully reproducible example in a single .qmd file? Please provide the whole file rather than the snippet you believe is causing the issue.
• Please format your issue so it is easier for us to read the bug report.
• Please document the RStudio IDE version you're running (if applicable), by providing the value displayed in the "About RStudio" main menu dialog?
• Please document the operating system you're running. If on Linux, please provide the specific distribution.

[MC-Escherichia]

I am getting this error, trying to use a corporate confluence domain, with a self signed certificate. It's unclear to me how I should configure my root certificate.

[dijitali]

Not 100% but could this relate to the fact that Deno uses a bundled set of Mozilla root CAs by default?

According to the docs, this might let you use the native cert store that curl and rsconnect-python will be using:

export DENO_TLS_CA_STORE=system
quarto publish connect inst/quarto.qmd --token $API_KEY --server $CONNECT_SERVER

[jjallaire]

Great find! I have made the following change to use both stores (giving preference to system): 8d1a882

This is available in our pre-release v1.4.128 now: https://quarto.org/docs/download/prerelease.html. If folks could give this a try we can back port the fix to v1.3 (cc @dragonstyle )

[cderv]

Fixed by 8d1a882

[madisonostermann]

I am encountering the same issue trying to publish a Quarto website to our Posit Connect server. quarto publish connect --server https://myserver.com and entering my API key results in the error:

ERROR: TypeError: error sending request for url (https://myserver.com/__api__/v1/user): error trying to connect: invalid peer certificate: UnknownIssuer

When I do the curl command curl -H "Authorization: Key $API_KEY" https://myserver.com/__api__/v1/content, I get a valid response. I've also checked that my certificate for the site is Always Trusted (on Mac, done in keychain access).

I'm able to publish via the button in RStudio without issue.

VERSIONS:
Quarto: version 1.5.54
OS: macOS 14.6.1 / Darwin 23.6.0
Connect version: 2024.03.0

[mcanouil]

Could you open a new issue (eventually referencing this one) and following the issue template? Thank you!