[Question] How to add a trusted certificate to resolve "Unable to verify the first certificate" error?

[perryton]

Describe the bug

Attempting to use the plugin with our hosted version of the IQ server (on our LAN) results in an error about "Nexus IQ extension failure: FetchError: request to ... failed, reason: unable to verify the first certificate."

To Reproduce

Steps to reproduce the behavior:
Just run a scan against our server.

Expected behavior

The server is accepted. I can currently access the server via browser without any certificate warnings/errors.

Desktop (please complete the following information):

OS: Windows 10
NodeJS Version: 14.15.4
VS Code Version: 1.65.2 (user setup)
Version of Extension: 1.2.3

Additional context

On extension version 1.2.3, the "unable to verify the first certificate" error is displayed regardless of whether the Nexus IQ: Strict SSL checkbox is checked or unchecked.

On extension version 0.8.3, the "unable to verify the first certificate" error is displayed only when the Nexus IQ: Strict SSL checkbox is checked. It appears to work properly when it is unchecked.

Questions

• Is there a trusted certificate store or certificate bundle that the extension uses?
• Would there be a way for me to add a certificate to that store/bundle, so that I don't encounter the certificate error?
• Is there a reason why I get the error on the recent extension versions regardless of Strict SSL setting, even though it appears to work with version 0.8.3 when Strict SSL is turned off?

I'm very new to how this extension works, so any help is appreciated. Thanks.

[MananShah9]

Instead of turning verification off go to the getToken Method in the extension.js file. Add a ca param with the required file.
Even if the solution is jank it is safer than skipping verification.

Hope this helps!🙂

[MananShah9]

I updated the code to support custom CA file selection but unfortunately I do not have permissions to create a pull request @davidkarlsen Can help?

[mLjH]

@MananShah9 could you share the code you updated?

[bhamail]

@MananShah9 You should be able to fork the repository and create a Pull Request from your fork.

[ArVar]

This is really an issue. This problem occurs apperently in scenarios with a corporate proxy. My proxy settings in .bashrc are not respected, as well. Somehow the interaction of my remote host, VSCode and the plugin regarding ssl settings is not clear for me.