Kong / Kong/insomnia

Windows - Insomnia does not allow SSL to host signed with local CA

Open
#6,407 3 comments 1 reaction 0 assignees View on GitHub
B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

Our company has its own CA. All our machines have the CA loaded into the Windows system certificate trust store. Accessing these hosts in a browser works fine. Doing an openssl s_client shows that the host I'm connecting to is signed by our internal root but Insomnia fails.
I just need to talk to an internal HTTPS host. Turning off validation is not an option.

### Actual Behavior

* Preparing request to https://<>/v2/oauth/token
* Current time is 2023-08-29T07:47:40.533Z
* Enable automatic URL encoding
* Using default HTTP version
* Enable timeout of 30000ms
* Enable SSL validation
* Trying 10.56.188.91:443...
* Connected to <> (10.56.188.91) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self-signed certificate in certificate chain
* Closing connection 0

### Reproduction Steps

_No response_

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

There is much previous discussion about issues like this but it appears Insomnia has changed since then and there's no long a local copy of the CA store.

### Insomnia Version

2023.5.6

### What operating system are you using?

Windows

### Operating System Version

Windows 10

### Installation method

Download from insomnia.rest

### Last Known Working Insomnia version

None

Contributor guide

Open the contributing guide

Research direction

No file, test, or entry point is identified. Start by tracing Insomnia's certificate-validation path on Windows and how it accesses the system trust store, then reproduce with a host signed by a local CA; done means the HTTPS request succeeds with SSL validation enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.