aws / aws/aws-toolkit-vscode

Codewhisperer can not be used behind proxy

Open
#4,056 2 comments 0 reactions 0 assignees View on GitHub
bug codewhisperer network partner-team
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

## Problem
2023-11-17 14:02:30 [ERROR]: webviewId="authWebview": Error: Webview error
-> Error: Webview backend command failed: "startCodeWhispererBuilderIdSetup()"
-> Error: Failed to connect to AWS Builder ID [FailedToConnect]
-> Error: Hostname/IP does not match certificate's altnames: Host: oidc.us-east-1.amazonaws.com. is not in the cert's altnames: DNS:tremorhub.com, DNS:*.partners.tremorhub.com, DNS:*.eb.tremorhub.com, DNS:*.cast.telaria.com, DNS:*.telaria.com, DNS:*.ads.tremorhub.com, DNS:*.tremorhub.com, DNS:*.publishers.tremorhub.com [ERR_TLS_CERT_ALTNAME_INVALID]

## Steps to reproduce the issue

## Expected behavior

## System details (run the `AWS: About Toolkit` command)
2023-11-17 14:02:30 [ERROR]: webviewId="authWebview": Error: Webview error
-> Error: Webview backend command failed: "startCodeWhispererBuilderIdSetup()"
-> Error: Failed to connect to AWS Builder ID [FailedToConnect]
-> Error: Hostname/IP does not match certificate's altnames: Host: oidc.us-east-1.amazonaws.com. is not in the cert's altnames: DNS:tremorhub.com, DNS:*.partners.tremorhub.com, DNS:*.eb.tremorhub.com, DNS:*.cast.telaria.com, DNS:*.telaria.com, DNS:*.ads.tremorhub.com, DNS:*.tremorhub.com, DNS:*.publishers.tremorhub.com [ERR_TLS_CERT_ALTNAME_INVALID]
2023-11-17 14:04:16 [INFO]: telemetry: sent batch (size=20)
2023-11-17 14:04:17 [INFO]: telemetry: sent batch (size=7)
2023-11-17 14:07:50 [INFO]: selected AWS ID sign in
2023-11-17 14:07:51 [ERROR]: API response (oidc.us-east-1.amazonaws.com /client/register): {
reason: "Host: oidc.us-east-1.amazonaws.com. is not in the cert's altnames: DNS:tremorhub.com, DNS:*.partners.tremorhub.com, DNS:*.eb.tremorhub.com, DNS:*.cast.telaria.com, DNS:*.telaria.com, DNS:*.ads.tremorhub.com, DNS:*.tremorhub.com, DNS:*.publishers.tremorhub.com",
host: 'oidc.us-east-1.amazonaws.com',
cert: {
subject: [Object: null prototype] { CN: 'tremorhub.com' },
issuer: [Object: null prototype] {
C: 'US',
O: 'Amazon',
CN: 'Amazon RSA 2048 M02'
},
subjectaltname: 'DNS:tremorhub.com, DNS:*.partners.tremorhub.com, DNS:*.eb.tremorhub.com, DNS:*.cast.telaria.com, DNS:*.telaria.com, DNS:*.ads.tremorhub.com, DNS:*.tremorhub.com, DNS:*.publishers.tremorhub.com',
infoAccess: [Object: null prototype] {
'OCSP - URI': [Array],
'CA Issuers - URI': [Array]
},
ca: false,
modulus: 'b0bd751fe95c7a3ea9c858faafc4581b6522f4f2751678a821fd89c75f8e31582896c12b707d35f5eed79014eefb416a811262bd8d01147ce82ea860e5b8c62f93ec5481129e1b03b8202741456bb88904c9f75fe101a5dccb9da90f7f56846e477cc44fa0c525cd4b552280c65c57627039b792f9d892c1bcdbc6e1c9717ee8fe7a0fe18a34f1a54aa79495d9b4e6c94f03d2ae0d65af9d1923cd4126debece42910ebfd4808dcf4f9e395b396f481ed046694ce218f4e062bc0c1264b36a53a8fbcace1c832174fa0c0a7c81ab9d1cf8ad09a19ac0dcbd81858e786a80c5e91f46970884a883ba118d53f1e335d65ee42a982e02dad29aa04330ba16ca517b',
bits: 2048,
exponent: '0x10001',
pubkey: ,
valid_from: 'Jul 3 00:00:00 2023 GMT',
valid_to: 'Jul 30 23:59:59 2024 GMT',
fingerprint: '19:A2:1F:26:7D:1F:7E:24:58:53:CE:9D:90:CD:A3:DD:82:1D:61:DD',
fingerprint256: '06:06:70:2F:1F:AF:66:09:C5:7E:BA:1D:2A:48:AC:F8:E4:EC:E2:47:59:A6:7A:8C:1E:0B:79:B0:07:61:0F:5A',
fingerprint512: 'D8:7F:B1:7D:20:68:9F:3C:11:CE:4A:E5:E0:D5:C8:DA:29:39:94:38:22:00:CD:67:6C:0C:19:B7:1A:02:BC:FC:25:00:E0:BC:D8:5C:09:24:0E:8B:70:5D:D1:92:43:09:83:99:30:EA:E0:E2:E9:5A:AE:5A:CA:11:A9:96:A3:14',
ext_key_usage: [ '1.3.6.1.5.5.7.3.1', '1.3.6.1.5.5.7.3.2' ],
serialNumber: '048550878c376615fc991bb97d9fafad',
raw: ,
issuerCertificate: {
subject: [Object: null prototype],
issuer: [Object: null prototype],
infoAccess: [Object: null prototype],
ca: true,
modulus: 'bb4318c65aa879de29e8b56f2ebea543cf2e58d3075e374a2e95a4458f73a9929058596ffeaaae4672a079502db0d89c8d83ee10f4b1dcc4a9f9ee02322cb9740b1b703c4ef5fa577a053411557bc3652c91ef06c78a63cf2c68bc2e7f191957093be20e275a534c5f395af58e45df0c111f03151f8e37c46cfa52d192652a90f78785c795fb4e5aadf30862f2a09a29d679acd6a4fabf6751384e78296a15de285f2721fff45ced8d1e5f528d587612235364df59988222b726f1f4eb783e2bdb4703add979380a82776587e588fb3bfb8b8e077a94598c0d45630619f55bfff54902e58cfcff253ae5f823684fb05473387bf6320b6a2cacf584ee027e7573',
bits: 2048,
exponent: '0x10001',
pubkey: ,
valid_from: 'Aug 23 22:25:30 2022 GMT',
valid_to: 'Aug 23 22:25:30 2030 GMT',
fingerprint: '41:4A:20:60:B7:38:C6:35:CC:7F:C2:43:E0:52:61:55:92:83:0C:53',
fingerprint256: 'B0:F3:30:A3:1A:0C:50:98:7E:1C:3A:7B:B0:2C:2D:DA:68:29:91:D3:16:5B:51:7B:D4:4F:BA:4A:60:20:BD:94',
fingerprint512: '5A:99:EE:B9:7B:B5:65:26:5F:E6:12:8A:BC:EC:C8:75:5D:BF:64:1C:B8:E7:20:59:6F:44:B9:7D:0F:39:E1:CC:CB:B8:07:48:70:48:B4:4A:5C:F9:B0:94:21:66:09:20:DC:7B:D8:74:48:5F:8A:E0:DF:DA:C2:A7:30:82:7B:F1',
ext_key_usage: [Array],
serialNumber: '0773124a4bcbd44ec7b53beaf194842d3a0fa1',
raw: ,
issuerCertificate: [Object]
}
},
code: 'ERR_TLS_CERT_ALTNAME_INVALID'
}
2023-11-17 14:07:51 [ERROR]: webviewId="authWebview": Error: Webview error
-> Error: Webview backend command failed: "startCodeWhispererBuilderIdSetup()"
-> Error: Failed to connect to AWS Builder ID [FailedToConnect]
-> Error: Hostname/IP does not match certificate's altnames: Host: oidc.us-east-1.amazonaws.com. is not in the cert's altnames: DNS:tremorhub.com, DNS:*.partners.tremorhub.com, DNS:*.eb.tremorhub.com, DNS:*.cast.telaria.com, DNS:*.telaria.com, DNS:*.ads.tremorhub.com, DNS:*.tremorhub.com, DNS:*.publishers.tremorhub.com [ERR_TLS_CERT_ALTNAME_INVALID]
2023-11-17 14:09:17 [INFO]: telemetry: sent batch (size=2)

Contributor guide

Open the contributing guide

Research direction

Start with the CodeWhisperer AWS Builder ID setup flow and the oidc.us-east-1.amazonaws.com request described in the logs, reproducing it behind the reported proxy. Done means Builder ID authentication works through that proxy without the TLS certificate hostname error, with the relevant behavior covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
authentication, cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.