Add support for enterprise SSL interception certificates

[mungojam]

Our company uses SSL interception with their own certificate which is trusted by windows.

When using aws-cdk, this leads to the inevitable error as node doesn't natively use windows cert store:

? Bootstrapping environment ###/eu-west-1...
? Environment ###/eu-west-1 failed bootstrapping: Error: self signed
certificate in certificate chain
at TLSSocket.onConnectSecure (_tls_wrap.js:1260:34)
at TLSSocket.emit (events.js:196:13)
at TLSSocket.EventEmitter.emit (domain.js:471:20)
at TLSSocket._finishInit (_tls_wrap.js:737:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:569:12) {
message: 'self signed certificate in certificate chain',
code: 'NetworkingError',
region: 'eu-west-1',
hostname: 'cloudformation.eu-west-1.amazonaws.com',
retryable: true,
time: 2019-05-06T16:46:50.195Z
}
self signed certificate in certificate chain

With our own node tools, we have circumvented this by using either syswide-cas or win-ca. VS Code recently integrated a win-ca fork as well so that no longer has the problem. This hasn't been possible with cdk as I don't seem able to inject the win-ca import early enough I think.

Please consider adding an integrated solution/option so that we can use CDK internally without having to mess with global environment variables.

I've worked around it for now setting the NODE_EXTRA_CA_CERTS environment variable to a snapshot of the certs extracted with win-ca but that's not a sustainable approach and would be messy to set up for other devs.

[nmussy]

Should this issue be brought to the AWS SDK for Node repo? All requests to the AWS are made through the SDK library AFAIK

[mungojam]

that's a good point, happy for somebody from aws move it over.

[nmussy]

I'm not sure that's possible. You can just open another issue there and reference this one as your use-case.

[mungojam]

It is possible 🙂

https://help.github.com/en/articles/transferring-an-issue-to-another-repository

[nmussy]

TIL! Thanks

[ajredniwja]

Hey @mungojam,

It doesn't seem to be a an issue with the JavaScript SDK.

If you still feel it is an issue with the JS-SDK then It'd be great if you can follow the issue template so that we can have more information about the issue.

[mungojam]

I probably won't get a chance to follow up on this as we've now moved to terraform rather than CDK. Happy to close unless others can follow up with reproductions

[ajredniwja]

@mungojam,

Thank-you for the update, I will go ahead and close the issue, if anyone has further questions, please re-open or create a new issue.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.