Open in VScode issue (self hosted)

[hm2075]

Bug description

using main.2090 branch

open in vscode option returns

Failed to connect to Gitpod workspace black-xerinae-jgitsfxe: FetchError: request to https://xxx.com/static/bin/gitpod-local-companion-windows.exe failed, reason: certificate has expired

same issue on previous builds

Steps to reproduce

install main.2090 , open gitpod and select open in vscode

Workspace affected

No response

Expected behavior

No response

Example repository

No response

Anything else?

No response

[akosyakov]

I think it is something wrong with your local certificates, probably they have to be updated.

[hm2075]

not entirely sure, certs are good
some other person mentioned the same issue in discord

[sedattanir]

I have same errors. My local certificates are signed by letsencrypt. I can't use this option. It does not give certificate error on localhost. The certificate appears to be signed.

[Pothulapati]

Hey 👋🏼

Today, I ran into this, while running a self-hosted instance of gitpod with let's encrypt for SSL!

Based of comments from #5944 (comment), This happens when your server's root cert is cross signed by the already expired DST ROOT CA X3 issuer cert, while your client isn't updated with the latest open-ssl that takes into account of the other signer of the cert i.e ISRG ROOT X1. This cross-signing is done to maintain backward compatibility with android devices by let's encrypt by default!

gitpod extension which uses node-fetch npm dependency, and code's underlying electron, to perform a fetch call on the URI to download the remote-local-companion app seem to use an older version of an ssl library (possible openssl) that hasn't got the latest changes, and hence the expired root certificate error. (i'm not entirely sure yet, on who exactly is the problem here i.e node-fetch or underlying electron in code)

There are multiple ways to get around this:

• Update the server to not have a root certificate that is cross signed by DST. For Self-Hosted, This means setting the preferredChain to ISRG Root X1 in the Issuer object of Cert Manager. I've tested this, and open in vs code seems to work after this change. But this means that the server would lose Android device compatibility prior to 7.1.0, which seems fine for gitpod self-hosted, as our clients are not native android clients, and this should work fine from browsers.

• Obviously, Like you'd expect it's more of a client issue than the server, as let's encrypt s trying to do the right thing i.e maintain device compatibility, while its the client who is struck on a older version. As we can't skip SSL verification in the extension for security reasons, We could first try to see if using a latest version of node-fetch fixes it. If that doesn't fix it, then it could be a underlying old ver dependency issue in code 🤔

[Pothulapati]

So, I was able to fix it by building a version of the gitpod extension that had a latest version of node-fetch. Obviously, As we can't expect servers to not have root certs signed by the expired DST ROOT CA X3 issuer. Updating the client, to use the latest version of SSL library that knows about ISRG Root X1 is the right way to fix this issue!

Will raise a PR, and update progress here in the issue! :)