-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Revise using of rejectUnauthorized #16906
Labels
area/chectl
Issues related to chectl, the CLI of Che
kind/task
Internal things, technical debt, and to-do tasks to be performed.
severity/P1
Has a major impact to usage or development of the system.
Comments
mmorhun
added
kind/task
Internal things, technical debt, and to-do tasks to be performed.
area/chectl
Issues related to chectl, the CLI of Che
labels
May 13, 2020
che-bot
added
the
status/need-triage
An issue that needs to be prioritized by the curator responsible for the triage. See https://github.
label
May 13, 2020
tolusha
added
severity/P1
Has a major impact to usage or development of the system.
and removed
status/need-triage
An issue that needs to be prioritized by the curator responsible for the triage. See https://github.
labels
May 13, 2020
Add some preflight chekcs, if cert is not valid, ask user to trust the server. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
area/chectl
Issues related to chectl, the CLI of Che
kind/task
Internal things, technical debt, and to-do tasks to be performed.
severity/P1
Has a major impact to usage or development of the system.
Is your task related to a problem? Please describe.
At the moment in
chectl
we userejectUnauthorized: false
option whenAxiosInstance
makes requests to Che API.Describe the solution you'd like
Current approach works fine, but the right way is to use specific CA certificate for such requests.
We've implemented retrieving of Che self-signed CA certificate which can be used to get the cert and pass to Axis to be able to connect to Che API without
rejectUnauthorized: fasle
option.However, retrieving the cert each time chectl is run will add a few seconds to command execution time (at this point we need to make sure, that self-signed certificate is using, which could be done by checking for
self-signed-certificate
secret in Che's namespace). To reduce this time we may try to cache the cert intmp
directory (it will not bring a security risk as we export only public part of Che root CA certificate).The text was updated successfully, but these errors were encountered: