How do I get Visual Studio Code to trust our self-signed proxy certificate?

Question

Our corporate firewall/proxy is keeping VS Code from being able to install extensions because Code doesn't trust something in the chain. It doesn't reliably give an error, but when it does, it's this: "self signed certificate in certificate chain".

This seems like it's an OpenSSL error, but I don't have enough familiarity with OpenSSL to know how to trust the certificate?

Answer 1

This is a terrible answer (not very secure), but appears to be the current Microsoft official answer. Use "http.proxyStrictSSL": false in your settings.json file.

This should work to get around the issue of installing extensions inside a corporate network, but I'd recommend disabling the setting if you are going to be working from home/coffee shop and not connected to the corporate VPN.

https://github.com/Microsoft/vscode/issues/3492

Answer 2

I was having the same issue, not when installing an extension, but when a certain extension was trying to download data. Adding "http.proxyStrictSSL": false to my settings file did not work. Disabling SSL is also a really bad idea.

The resolution was to install the Visual Studio Code win-ca plugin which makes trusted Windows certificates available to extensions.

Answer 3

There is actually a better way:

Since VS Code is built on Chromium the "proxy settings should be picked up automatically" from Google Chrome/Chromium. So if you add your self-signed certificate in Chrome/Chromium by going to:

1. chrome://settings/privacy
2. Manage certificates
3. Authorities / Import
4. Select and import your certificate (pem-file)
5. Restart VS Code

I was able to download VS Code extensions despite being behind a corporate proxy.

Remark: Ubuntu 18.04 and VS Code works only with Chrome and not Chromium.

Answer 4

EDIT: Still works in 2021 on Big Sur and Catalina, maybe others

First, make sure that the certificates are installed and trusted (I have them in the System category).

Then, go into VScode settings, Application, Proxy, and UNCHECK the "System certificates" option. Restart vscode and RE-CHECK it. Restart again, and it works.

No idea why you have to do this, but it worked for me. I was very surprised. The error I was getting in the developer console (Help - toggle developer tools - console tab) was "self signed certificate in certificate chain".

Answer 5

I had this issue inside WSL2 (Ubuntu). For me, the solution was to add a new environment variable to /etc/environmentcalled NODE_EXTRA_CA_CERTS and add my proxy's certificate to it. This will fix the problem for all Node instances that respect this variable, not just VS Code and/or Electron, which is exactly what I need.

Reference: https://nodejs.org/api/cli.html#node_extra_ca_certsfile

Answer 6

I had to add the corporate certificate as a root CA to my local NSS store to get this to work.

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> -i <certificate filename>

See this GitHub issue for more info.

Answer 7

I finally have found a solution that works with VS Code for those who still run into issues using win-ca.

For those who use things including GitHub Copilot have a odd reason of not respecting NODE_EXTRA_CA_CERTS system variable and therefore need a little bit more work.

If you already have a .pem file ignore this step and move forward.

Go to your choice of browser and go to: github.com Exporting the certificate as a Base64-encoded ASCII, certificate chain and making sure the extension of the file ends with .pem

Then, setting NODE_EXTRA_CA_CERTS variable into user variable (If set as a System Var will not work) with your included .pem file.

After adding the user variable, go to your VS Code installation and finding the Github Copilot extension folder and then going under the /dist directory.

Open extension.js file in a code editor and add this code to the top of the extensions file.

const tls = require("tls");
const fs = require("fs");

const origCreateSecureContext = tls.createSecureContext;

tls.createSecureContext = options => {
  const context = origCreateSecureContext(options);

  const pem = fs
    .readFileSync(process.env.NODE_EXTRA_CA_CERTS, { encoding: "ascii" })
    .replace(/\r\n/g, "\n");

  console.log(pem);

  const certs = pem.match(/-----BEGIN CERTIFICATE-----\n[\s\S]+?\n-----END CERTIFICATE-----/g);

  if (!certs) {
    throw new Error(`Could not parse certificate ${process.env.NODE_EXTRA_CA_CERTS}`);
  }

  certs.forEach(cert => {
    context.context.addCACert(cert.trim());
  });

  return context;
};

This forces Github Copilot to add self signed certificates and lets it work under proxies and Corporate networks.

Answer 8

Try the following steps, which helped me to resolve similar issue:

1. Open a corporate portal home page in browser and download Root CA certificate. This certificate is usually the first one in the hierarchy of 3 certificates available there. Another option is to ask security team to provide you a corporate Root CA certificate file in Base-64 format.

2. Right-click the certificate file and select Install Certificate.

3. Add Windows Environment variable NODE_EXTRA_CA_CERTS with path to this certificate file.

4. Restart Visual Studio Code and try again.

Answer 9

I encountered the issue above when opening a proxy tool like Charles. The error disappeared after closing that proxy tool.

Answer 10

I know this is not the best option, but I had to add certificate to Java cacerts.