link之家
链接快照平台
- 输入网页链接，自动生成快照
- 标签化管理网页链接
相关文章推荐
|
神勇威武的跑步机 · 十年前詹姆斯“决定”大揭秘 ...· 3 月前 · |
|
|
仗义的楼房 · 驻冰岛大使金智健赴诺娃（Nova）公司参观调研· 8 月前 · |
|
|
玩足球的爆米花 · 计划年内上市，新款美规雷克萨斯RX ...· 1 年前 · |
|
|
潇洒的茶壶 · #电影诛烬枭亡是加强版狂飙 - 抖音· 1 年前 · |
https://medium.com/@jonatascastro12/understanding-self-signed-certificate-in-chain-issues-on-node-js-npm-git-and-other-applications-ad88547e7028
https://stackoverflow.com/questions/45088006/nodejs-error-self-signed-certificate-in-certificate-chain
Thanks,
Cause
The problem was that the company firewall's certificate is self-signed (rather than being issued by a certificate authority). This can be observed by using openssl. Run the command openssl s_client -showcerts -connect salesforce.com:443 in the terminal that threw the self-signed error. The output of the openssl command shows the chain of certificates used by the connection request. Notice the "firewall_root" certificate has matching subject and issuer lines.
Connections with a self-signed certificate in the certificate chain are rejected by sfdx, because sfdx uses Node.js, and Node distrusts self-signed certificates by default, for security.
Resolution
1. Save the self-signed company firewall certificate to your computer by copying the certificate text from the openssl command output (including the "----- START/END CERTIFICATE -----" delimiters; copy the company firewall certificate only) to a new text file, and change the extension to ".pem" (dismiss the warning about changing file extensions).
2. Tell Node (and thereby sfdx) to trust the self-signed certificate. This can be done by setting the NODE_EXTRA_CA_CERTS environment variable with the command $Env:NODE_EXTRA_CA_CERTS = "C:\\path\\to\\newFirewallCert.pem" where the path is to your cert file.
3. You can now use sfdx again
https://docs.netskope.com/en/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception.html
However, I found the mac script buggy. I used (zsh): % security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain/Library/Keychains/System.keychain > /tmp/nscacert_combined.pem % sudo cp /tmp/nscacert_combined.pem /Library/Application\ Support/Netskope/STAgent/download/ Note the first shell command line above is wrapping.
And then added the env variable:
export NODE_EXTRA_CA_CERTS='/Library/Application Support/Netskope/STAgent/download/nscacert_combined.pem'