VSCode Semgrep Extension failing to update rules behind inspecting proxy

[mitch-athena]

I'm behind an inspecting proxy and having this issue running semgrep in VSCode and already have the REQUESTS_CA_BUNDLE exported, as well as CERT_PATH, CERT_DIR, SSL_CERT_FILE, SSL_CERT_DIR as this also fixes TLS issues for PIP. Any idea what else is needed to get this working?

Error Notification in VSCode:

Fatal error: Failed to download config from https://semgrep.dev/c/p/default: TLS failure: authentication failure: invalid certificate chain

Error in output log from Semgrep extension in VSCode:

Refreshing rules
[73.00][ERROR]: Uncaught async exception: Fatal error: Failed to download config from https://semgrep.dev/c/p/default: TLS failure: authentication failure: invalid certificate chain

No issue running semgrep from the CLI though.

Originally posted by @mitch-athena in semgrep/semgrep#5084 (comment)

I noticed this has been raised before here #62 and was supposedly fixed in #63, however the issue seems to persist.

[ajbt200128]

Hey so it turns out that issue was never actually fixed, and we have been working on a fix for awhile now. It'll probably be another month until we can get that fix through though as it depends on updating a dependency.

[mitch-athena]

Glad it wasn't just me then 😅

Will check back here later then, thanks!

[mitch-athena]

Hey @ajbt200128, is there any update on whether this issue has been resolved yet?

[ajbt200128]

Not yet, there are some PRs that need to be merged into the libraries we use before this is possible

[vbakke]

I can confirm that this issue applies to the Semgrep plugin in IntelliJ as well.

Semgrep: Fatal error: Failed to download config from https://semgrep.dev/c/p/default, returned code 0: Error: self-signed certificate in certificate chain at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34) at TLSSocket.emit (node:events:517:28) at TLSSocket._finishInit (node:_tls_wrap:1070:8) at ssl.onhandshakedone (node:_tls_wrap:856:12)

The so called 'self-signed' certificate, is a root CA certificate, that is in my Windows Certificate Store under Trusted Root Certificates. I had to manually insert it into Java's keytool. I guess python has the same issue...(?)

[manumns]

I also get this error.
In my case, it also fails to login to Sempgrep in the first place when I select >Semgrep: Sign in

Failed to complete login process: ERROR Login Failed! We had an unexpected failure while trying to make a network request to https://semgrep.dev/api/agent/tokens/requests: TLS failure: authentication failure: invalid certificate chain Please check network settings and try again or reach out to Semgrep support at �[36m�[4mhttps://semgrep.dev/docs/support/�[39m�[24m

I also have no issue running semgrep from the CLI.

[vbakke]

Maybe https://gitlab.com/alelec/pip-system-certs contains any hints for a potential solution?

[cerojasg1]

It seems the issue is still happening, doesn't it?

[ajbt200128]

yup this is still an issue. Should be fixed once some updates to some networking related ocaml packages are merged and released