|
|
相关文章推荐
|
坏坏的饭盒 · MATLAB一维数组求转置，反序输出-CSDN博客· 2 年前 · |
|
|
豪气的双杠 · Disabling ARR’s ...· 2 年前 · |
|
|
英姿勃勃的地瓜 · django初始化配置及创建数据库表-天翼云· 2 年前 · |
|
|
率性的红酒 · Python logging 模块之 ...· 2 年前 · |
|
|
强悍的毛豆 · authentication - ...· 2 年前 · |
https://medium.com/@jonatascastro12/understanding-self-signed-certificate-in-chain-issues-on-node-js-npm-git-and-other-applications-ad88547e7028
https://stackoverflow.com/questions/45088006/nodejs-error-self-signed-certificate-in-certificate-chain
Thanks,
Cause
The problem was that the company firewall's certificate is self-signed (rather than being issued by a certificate authority). This can be observed by using openssl. Run the command openssl s_client -showcerts -connect salesforce.com:443 in the terminal that threw the self-signed error. The output of the openssl command shows the chain of certificates used by the connection request. Notice the "firewall_root" certificate has matching subject and issuer lines.
Connections with a self-signed certificate in the certificate chain are rejected by sfdx, because sfdx uses Node.js, and Node distrusts self-signed certificates by default, for security.
Resolution
1. Save the self-signed company firewall certificate to your computer by copying the certificate text from the openssl command output (including the "----- START/END CERTIFICATE -----" delimiters; copy the company firewall certificate only) to a new text file, and change the extension to ".pem" (dismiss the warning about changing file extensions).
2. Tell Node (and thereby sfdx) to trust the self-signed certificate. This can be done by setting the NODE_EXTRA_CA_CERTS environment variable with the command $Env:NODE_EXTRA_CA_CERTS = "C:\\path\\to\\newFirewallCert.pem" where the path is to your cert file.
3. You can now use sfdx again
https://docs.netskope.com/en/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception.html
However, I found the mac script buggy. I used (zsh): % security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain/Library/Keychains/System.keychain > /tmp/nscacert_combined.pem % sudo cp /tmp/nscacert_combined.pem /Library/Application\ Support/Netskope/STAgent/download/ Note the first shell command line above is wrapping.
And then added the env variable:
export NODE_EXTRA_CA_CERTS='/Library/Application Support/Netskope/STAgent/download/nscacert_combined.pem'