windows - Dealing with corporate firewall adding self-signed certificates -
i work in small group inside of large company.
all network traffic goes through company's firewall, think acts man-in-the-middle when traffic comes in.
one example see when using curl
c:\>curl https://www.google.com curl: (60) ssl certificate problem: self signed certificate in certificate chain
so check certificate chain with:
c:\>openssl s_client -connect google.com:443
and (with details removed)
certificate chain 0 s:/c=us/st=california/l=mountain view/o=google inc/cn=*.google.com i:/c=us/my company's intermediate ca 1 s:/c=us/my company's intermediate ca i:/c=us/my company's root ca 2 s:/c=us/my company's root ca i:/c=us/my company's root ca
this provides challenge using package managers npm or composer because https
fails due self-signed certificate error, or not being able verify certificate
i can npm work setting config values ca=""
, strict-ssl=false
, that's insecure practice.
i'd our development team have access package managers, npm , composer
given i'm not going able change how firewall works, there changes can make on local machine (windows 7) or vm (windows server 2008 r2) allow our development team utilize these package managers securely.
thanks!!
i asked around @ company , talked right person said:
all our internet traffic passes through company. company intercepts https traffic, replaces certificate , adds own certificate. can decrypt , analyze encrypted traffic (essentially man in middle attack).
company root certificate must trusted avoid warnings , errors.
i got link download proper pem key.
using key able set proper config options various package managers.
npm
npm config set cafile c:\\path\\to\\cert.pem npm config set strict-ssl true
(needed double slashes in windows)
composer
had set values in php.ini composer work.
openssl.cafile = c:\path\to\cert.pem curl.cainfo = c:\path\to\cert.pem
for other programs threw certificate error (not verified, self-signed, etc), ended finding sort of config setting point pem file , work.
Comments
Post a Comment