redhat-developer / redhat-developer/vscode-java
Component Analysis Error - doesn't work behind Zscaler SSL intercepting network component
未关闭
还没有人认领这个 Issue。
- 主要语言
- TypeScript
- 星标
- 2.3k
- 派生
- 546
- 平均合并
- 20 小时 1 分钟
- 30 天内合并 PR
- 11
描述
[provide a description of the issue]
[Warn - 4:04:18 PM] Component Analysis Error: FetchError: request to https://exhort.stage.devshift.net/api/v4/analysis failed, reason: unable to get local issuer certificate
Environment
- Operating System: Windows 10 with WSL 2 Ubuntu 22.3.04
- JDK version: java 21.0.1 2023-10-17
Java(TM) SE Runtime Environment Oracle GraalVM 21.0.1+12.1 (build 21.0.1+12-jvmci-23.1-b19)
Java HotSpot(TM) 64-Bit Server VM Oracle GraalVM 21.0.1+12.1 (build 21.0.1+12-jvmci-23.1-b19, mixed mode, sharing) - Visual Studio Code version: 1.85.1
- Java extension version: 1.25.1
Steps To Reproduce
- Install extension
Additional information
openssl s_client -CApath /etc/ssl/certs/ -connect exhort.stage.devshift.net:443
CONNECTED(00000003)
depth=3 C = US, ST = California, L = San Jose, O = Zscaler Inc., OU = Zscaler Inc., CN = Zscaler Root CA, emailAddress = support@zscaler.com
verify return:1
depth=2 C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = Zscaler Intermediate Root CA (zscloud.net), emailAddress = support@zscaler.com
verify return:1
depth=1 C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = "Zscaler Intermediate Root CA (zscloud.net) (t) "
verify return:1
depth=0 CN = exhort.stage.devshift.net
verify return:1
---
Certificate chain
0 s:CN = exhort.stage.devshift.net
i:C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = "Zscaler Intermediate Root CA (zscloud.net) (t) "
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Dec 17 03:28:51 2023 GMT; NotAfter: Dec 31 03:28:51 2023 GMT
1 s:C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = "Zscaler Intermediate Root CA (zscloud.net) (t) "
i:C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = Zscaler Intermediate Root CA (zscloud.net), emailAddress = support@zscaler.com
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Dec 17 03:28:51 2023 GMT; NotAfter: Dec 31 03:28:51 2023 GMT
2 s:C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = Zscaler Intermediate Root CA (zscloud.net), emailAddress = support@zscaler.com
i:C = US, ST = California, L = San Jose, O = Zscaler Inc., OU = Zscaler Inc., CN = Zscaler Root CA, emailAddress = support@zscaler.com
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Jun 5 05:33:19 2020 GMT; NotAfter: Jun 23 05:33:19 2041 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIID5jCCAs6gA*******content-removed********Bq8BhCdb
-----END CERTIFICATE-----
subject=CN = exhort.stage.devshift.net
issuer=C = US, ST = California, O = Zscaler Inc., OU = Zscaler Inc., CN = "Zscaler Intermediate Root CA (zscloud.net) (t) "
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 3872 bytes and written 767 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
首先,在报告的 Windows 10 和 WSL 2 Ubuntu 环境中启用 Zscaler SSL 拦截,并复现发送到 https://exhort.stage.devshift.net/api/v4/analysis 的组件分析请求。跟踪扩展如何处理 unable-to-get-local-issuer-certificate 错误;完成标准是在不弱化证书验证的情况下,使组件分析在此环境中正常工作。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- java, typescript
- 领域
- developer-experience, networking, security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 35/100