Automatic import of private CA certificates in Windows.#3441
Automatic import of private CA certificates in Windows.#3441Cesar-DC wants to merge 1 commit intojfrog:masterfrom
Conversation
|
I have read the CLA Document and I hereby sign the CLA CULOT CÉSAR seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. |
| @@ -0,0 +1,71 @@ | |||
| package certbootstrap | |||
| return filepath.Join(home, ".jfrog") | ||
| } | ||
|
|
||
| func PersistVerifiedChain(jfrogHome string, chain []*x509.Certificate) (int, error) { |
There was a problem hiding this comment.
why do we need to persist the chain ?
There was a problem hiding this comment.
Go on Windows can validate a certificate against the CAs available in the Windows certificate store (typically managed by a corporate PKI team).
If the connection is successfully validated by Go, we can safely extract and copy the certificate chain into the location expected by JFrog CLI (~/.jfrog/security/certs).
This approach avoids a full rewrite of the CLI to directly support the Windows certificate store. Instead, it preserves the existing mechanism (manual placement of private CA certificates), while leveraging Go’s ability to interact with the system certificate store to ensure the chain we import is trusted.
|
It should be handled in https://github.com/jfrog/jfrog-client-go/blob/master/auth/cert/sslutils_windows.go |
|
Even better, we have a 5 lines fix then https://github.com/jfrog/jfrog-client-go/blob/master/auth/cert/loader.go replace: with: Tested locally. |
2 participants
Summary
This PR adds a Windows-specific preflight step to improve handling of private PKI certificates in JFrog CLI.
When a command includes a target URL, the CLI:
~/.jfrog/security/certs
Motivation
On Windows, JFrog CLI may fail with:
even when the certificate is already trusted by the OS.
Manually exporting the site certificate from a browser and placing it in
~/.jfrog/security/certsresolves the issue.This patch automates that process.
Behavior
--urlorJFROG_URLis providedTesting
Validated locally: