search

bufferoverflow / verdaccio-gitlab

private npm registry (Verdaccio) using gitlab-ce as authentication and authorization provider
MIT License
160 stars 55 forks source link

Can't connect to a gitlab server with https:// using custom CA signed certificates #15

Closed qtiki closed 6 years ago

qtiki commented 6 years ago

The plugin fails to connect to a private gitlab instance with https:// protocol if the host's certificate is signed by a custom Certificate Authority. I believe this is related to https://github.com/nodejs/node/issues/4175

It seems that sinopia-gitlab supports a custom ca certificate via the gitlab_ca_file config option, so maybe something similar could be added to verdaccio-gitlab too?

bufferoverflow commented 6 years ago

merge requests are welcome ;-)

qtiki commented 6 years ago

I just bumped into this: https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file

Seems that since Node v7.3.0 it is possible to work around this issue with an environment variable. I haven't yet tried this with verdaccio-gitlab, but it did indeed fix a similar issue I was having with semantic-release/gitlab. I'll post an update here when I get around to testing this with our verdaccio server.

dlouzan commented 6 years ago

@qtiki Could you let us know if were able to solve this issue? i don't know if we still need to add any support for this :-)

qtiki commented 6 years ago

@dlouzan IIRC I was having this issue with user authentication. I took the "easy way out" and skipped user authentication entirely. Our Verdaccio instance is accessed via a vpn so it would have been a bit redundant anyway.

As far as I'm concerned, the workaround I mentioned with the Node environment variable is the proper way to do this. It is more a problem in Node than Verdaccio as it affects pretty much everything that uses https with corporate certificate authority. And since Node 8 (which is the current LTS version) has this workaround I'd say don't do anything about this. Maybe worth mentioning somewhere in the docs, but then again this is probably "common knowledge to anyone who uses Node with a corporate CA".

dlouzan commented 6 years ago

Thank you!