Error on Login: error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

[zilan920]

Hi,
I meet an error on railway login on network. I am using zscaler on company computer, and as zscaler says, i will need to add zscalar CA cert, but i don't find any way to add cert path or ignroe SSL check.

zscaler page:
https://help.zscaler.com/zia/adding-custom-certificate-application-specific-trust-store

error :
`
➜ ~ railway login

Open the browser? Yes
Failed to fetch: error sending request for url (https://backboard.railway.app/graphql/v2): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

Caused by:
0: error sending request for url (https://backboard.railway.app/graphql/v2): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
1: error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
2: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
`

`
➜ ~ railway login --browserless

Browserless Login
Failed to fetch: error sending request for url (https://backboard.railway.app/graphql/v2): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

Caused by:
0: error sending request for url (https://backboard.railway.app/graphql/v2): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
1: error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
2: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
`

[github-actions]

Hello, @zilan920! Thanks for your submission.

Our team will respond soon. If you need more immediate help, try our Forum or our Discord. Thanks!

[coffee-cup]

This seems to be an error with your network. Can you access https://backboard.railway.com or railway.com normally?

Closing as there is nothing on our side we can do

[cflee]

@coffee-cup Could you consider supporting having the HTTP client use the system CA certificate store, e.g. by using reqwest's rustls-tls-native-roots feature, and/or support some other way to specify some additional CA certificates that should be trusted?

There are many enterprise settings where it is expected that making TLS connections to external internet services like backboard.railway.com will receive a server certificate signed by a special enterprise-specific CA certificate (typically already installed in the system's CA certificate store) instead of the original publicly trusted CA certificate. Currently this CLI using the rustls-tls feature is effectively rustls-tls-webpki-roots which limits acceptance to only CA certificates from the Mozilla store.