Use behind a corporate proxy #314
Comments
|
Hi, I'm going to need to know more details. What OS are you using? what version of fnm? |
|
OS: 10.15 - Catalina |
|
Can you try building fnm on your machine and tell me if it is working well? |
|
I'm getting a possibly related issue when running behind a corporate proxy with authentication and a custom certificate ( which I have trusted on my machine and which works will most other apps such as I get the same issue when installing fnm from source using |
|
Ah, I was able to fix it by disabling the Coincidentally this is exactly the same problem I ran into with Deno today. |
|
Oh cool, thanks for checking it out! |
|
I ran into a similar issue, I'll need to retest with the latest release which has the newest Looking at their doc tho it seems |
|
I've tested with It worked without proxy and with proxy (if someone wants to try it before it lands I didn't look at the difference between |
Addresses Schniz#314 allowing use of fnm when behind a proxy with certificates. This adds the `"rustls-tls-native-roots"` [cargo feature](https://docs.rs/reqwest/0.11.3/reqwest/#optional-features) to reqwest. That uses [rustls-native-certs](https://github.com/rustls/rustls-native-certs): > rustls-native-certs allows rustls to use the platform's native certificate store when operating as a TLS client. I tested on macOS both with and without proxy mainly doing `cargo run -- list-remote`, and installing node 16, this worked behind proxy. Without proxy I only tested list-remote. Perhaps other commands need to be retested as well. The [`native-tls`](https://docs.rs/native-tls/0.2.7/native_tls/) feature might also work, I didn't test. They seem to cover similar functionality but maybe it works better on Linux ARM systems.
|
I am getting a similar error on Windows 10 20H2 while having installed via chocolatey:
A possible workaround is to disable one's company VPN / proxies and then download node versions |
|
I use fnm on Linux behind a proxy with a custom SSL certificate, but I have to use the I'm not if it works on Windows, but have you trusted your proxy certificate in your Windows network settings. If I remember correctly, it's kind of in the internet explorer / edge settings ( even if you don't use internet explorer ). |
|
I'm on macOS and I'm getting UnknownIssuer on 1.28.2. #468 was removed but there's no equivalent replacement. How should I bypass this problem? The corporate proxy on my machine MITM the TLS connection and rewrites the cert, how do I accept the cert, even on TOFU manner? |
|
@cko-jimmy-wong worst case scenario you can just apply these changes and build it from source to use it behind a proxy. @Schniz will have to decide what the best way to support all platforms is being that it seems like some platforms work better with different features enabled, but if you are find building from source, then that should work for you for now. |
|
I probably forgot to apply the feature when I reverted. We can do this again |
|
Indeed looks like https://github.com/Schniz/fnm/pull/586/files doesn't include The revert mentions testing, the proxy might be testable in a container given that there's a small proxy that can run in the container too. Maybe something like https://dev.to/andre/docker-restricting-in--and-outbound-network-traffic-67p could be used to drop the non proxy traffic, so that the test fails if it doesn't use the proxy. Then there would be the tls part... sounds like it would make for one big e2e test to check all that! |
Addresses Schniz#314 allowing use of fnm when behind a proxy with certificates by reapplying Schniz#468 after the revert from ureq to reqwest. This adds the `"rustls-tls-native-roots"` [cargo feature](https://docs.rs/reqwest/0.11.3/reqwest/#optional-features) to reqwest. That uses [rustls-native-certs](https://github.com/rustls/rustls-native-certs): > rustls-native-certs allows rustls to use the platform's native certificate store when operating as a TLS client. I tested on macOS both with and without proxy mainly doing `cargo run -- list-remote`, and installing node 16, this worked behind proxy. Without proxy I only tested list-remote. Perhaps other commands need to be retested as well. The [`native-tls`](https://docs.rs/native-tls/0.2.7/native_tls/) feature might also work, I didn't test. They seem to cover similar functionality but maybe it works better on Linux ARM systems.
Addresses #314 allowing use of fnm when behind a proxy with certificates by reapplying #468 after the revert from ureq to reqwest. This adds the `"rustls-tls-native-roots"` [cargo feature](https://docs.rs/reqwest/0.11.3/reqwest/#optional-features) to reqwest. That uses [rustls-native-certs](https://github.com/rustls/rustls-native-certs): > rustls-native-certs allows rustls to use the platform's native certificate store when operating as a TLS client. I tested on macOS both with and without proxy mainly doing `cargo run -- list-remote`, and installing node 16, this worked behind proxy. Without proxy I only tested list-remote. Perhaps other commands need to be retested as well. The [`native-tls`](https://docs.rs/native-tls/0.2.7/native_tls/) feature might also work, I didn't test. They seem to cover similar functionality but maybe it works better on Linux ARM systems.
|
This should be fixed already! Thanks @pfiaux! 🙌 |
Is there an option where I could add a certificate to use this tool given that I want to use this tool behind a corporate proxy?
Currently, I am seeing this error.
HttpError: error sending request for url (https://nodejs.org/dist/index.json): error trying to connect: invalid certificate: UnknownIssuer
The text was updated successfully, but these errors were encountered: