-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x509: certificate signed by unknown authority #385
Comments
I am also seeing this error message on my Windows 10 work laptop when I hover over the "WakaTime Error" in the within VSCode status bar (blue bar at the bottom of VSCode). When I opened the
|
Please try setting
|
@gandarez - Thanks. Setting |
Please upgrade your vscode extension to v10.0.0 to fix the error. We've rolled back wakatime-cli for now until we can fix this error. |
@bharatpaliwal-169 and @akaustav to help us debug this, do you have a proxy configured in your |
@alanhamlett no there is no proxy configured in |
@alanhamlett - I do NOT have any proxy configured in my
|
We've released some updates to wakatime-cli now. Can you please add these lines to your
(If you already have |
@alanhamlett - I made the change in my local - where WakaTime was already working. After this change, WakaTime is back to showing the same "WakaTime Error" in the VSCode status bar. There are 2 errors in the Updated
Errors in
|
After #411 gets merged we'll re-enable Go wakatime-cli for vscode. I'll comment here before doing that, so you know to watch for any errors. Hopefully that fixes it though. |
Re-launching Go wakatime-cli in VS Code now, so keep an eye on your WakaTime status bar to make sure the plugin is working if you reload/relaunch your VS Code window. |
Thanks, @alanhamlett. I didn't have time to test this during the weekend. I'll test it in the morning. |
@alanhamlett - I tried - no dice.
When restart VSCode without opening any files, in the status bar I get the WakaTime logo. Upon hovering on the logo, I see
If it matters, I have the latest (non-insiders) build for VSCode. Following taken from
|
@alanhamlett - I noticed that the existing configurations already had white-spaces on either side of the equals symbol.
And it still fails with the same errors - worth a shot, I guess. |
@akaustav it looks like there was an error with the last release where it wasn't actually published. Can you try again and see if it's fixed by adding the lines to your
|
@bharatpaliwal-169 @akaustav Would you be willing to attend a video call so we can screen share and debug this issue? It would help a ton, since we haven't been able to reproduce it yet on our Windows test environments. |
@alanhamlett - Sorry, I was on vacation - hence, slow response. Re-tried - same error in
|
@akaustav thanks! We're working on figuring out why the bundled SSL cert isn't working in only some Windows environments. I'll update here once we have more details. |
Thanks. BTW, this problem seems to occur in my work laptop running Windows 10 only. Personal Windows 10 laptop with the same version of vscode and wakatime extension seems to work fine. It is possible that the problem may be related to extra certificates which may have been installed on my work laptop (by my admin team) and might not be a problem with your certificates. Or it may be related to your certificates. Not completely sure what can I do to help with the root cause. They may have restrictions on video call + screenshare on my work laptop. |
@alanhamlett - I have found a few items which may help troubleshoot this issue a bit more.
|
That means your work computer uses a proxy, which has it's own SSL cert being a MITM between your work machine and WakaTime. When we merged #411, wakatime-cli started using the system's SSL certs which should include your work's proxy cert. Two questions:
|
@alanhamlett - You might be right about the proxy + MITM setup. I noticed that the my older Firefox profile was having issues connecting to https websites - even https://www.google.com/. I had to start a fresh Firefox profile and that fixed the connection problems. Answers to your questions inline below.
I think my company's certificate was imported automatically by my company's admin team - using their automated desktop administration tools. I imported WakaTime's public certificate chain (obtained from https://wakatime.com/ in Firefox) with the
In my windows command prompt (
However, the curl command works if I run it with the
|
That curl error is probably the same thing wakatime-cli is running into. Maybe Python wakatime-cli doesn't check for revocation when verifying ssl certs but Go wakatime-cli does.
That won't work, since your work computer receives the proxy's company cert when connecting to wakatime. The issue here is Go wakatime-cli isn't trusting your company's proxy cert. Let's check if that's the case by running this Terminal command:
Where your proxy cert pem file should be the one that's verified by "My company name here". If that prints something like |
Actually, it looks like Go doesn't check cert revocation so it must be just not finding the proxy cert due to it not being in the system pool or from a hostname mismatch. |
We can disable hostname verification, but that decreases security for everyone. Python also checks the hostname of the cert and Python is working, so maybe Go is checking it slightly differently somehow. |
Now that we have logs aggregation, I'm seeing these error logs from Windows users that might be the same as this issue:
The |
@alanhamlett Somehow they reverted the existing functionality for loading system roots in go 1.8, as you can see here: https://github.com/golang/go/blob/master/src/crypto/x509/root_windows.go#L286 Issue is explained in: golang/go#18609. Windows obviously does not ship with all root certificates installed, but downloads some on-demand. |
Workaround for now would be disabling SSL as fallback on Windows? |
No, it's not safe. Looks like there are two workarounds:
We could use that code in our project to get the system root certs on Windows without |
Let's just implement our own root_windows.go without the wakatime-cli/pkg/api/transport.go Line 108 in e434f95
The reason they disabled getting root certs on Windows was because the implementation only returned root certs already used at least once, and was missing any root certs not yet used. Apparently because Windows lazy-downloads root certs on first use. For us, this doesn't matter because we bundle our root cert and the only time we need system certs is for corporate proxies where the root cert will already be installed. |
@bharatpaliwal-169 @akaustav please delete the lines |
@alanhamlett - You are correct. It looks fixed now. |
Hey @akaustav @bharatpaliwal-169 sorry to bump this very old thread. I'd like to test another version to see if it works in the same machine or environment that initially has broken, can you join us in Slack and poke me? |
checked every file and reinstalled the extension for about 100 times and regenerated API key also but nothing is working.
Please Help
The text was updated successfully, but these errors were encountered: