配置流浪CA证书

Question

我遇到执行后面的企业代理服务器和自签署的CA证书流浪命令的问题。我配置了环境变量HTTP_PROXY，HTTPS_PROXY和HTTP_NO_PROXY变量。

我有一个包含所有企业证书的一个Java密钥存储。我使用了许多选项的keytool命令的-exportcert选项。我已经使用了openssl命令，并有很多选项，并将结果文件放在Vagrant安装的嵌入式Ruby目录中的多个位置，没有任何成功。

我已经读了很多关于含有配置Ruby和卷曲的信息的网站，但还没有在得到命令流浪工作取得任何成功。所有我已经找到专注于Ruby和卷曲选项职位，我不明白如何与流浪者，其中包括红宝石作为流浪的嵌入式组件使用的。

请提供有关如何正确地从Java密钥库导出证书的说明和可选转换它们，并把生成的文件，这样流浪能够成功能够通过企业代理网络进行通信。

流浪1.9.5在Windows 7

流浪安装目录C：\ APPS \流浪\

C:\WorkArea> vagrant plugin install vagrant.proxyconf 

ERROR: SSL verification error at depth 3: self signed certificate in certificate chain (19) 
ERROR: Root certificate is not trusted (/C=US/O=xxx xxx/OU=xxx xxx Certification Authority/CN=xxx xxx Root Certification Authority 01 G2) 
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://api.rubygems.org/specs.4.8.gz) 

C:\WorkArea> vagrant up 

Bringing machine 'default' up with 'virtualbox' provider... 
==> default: Box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found. Attempting to find and install... 
    default: Box Provider: virtualbox 
    default: Box Version: >= 0 
The box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found or 
could not be accessed in the remote catalog. If this is a private 
box on HashiCorp's Atlas, please verify you're logged in via 
`vagrant login`. Also, please double-check the name. The expanded 
URL and error message are shown below: 
URL: ["https://atlas.hashicorp.com/puppetlabs/ubuntu-16.04-64-puppet"] 
Error: SSL certificate problem: self signed certificate in certificate chain 
More details here: http://curl.haxx.se/docs/sslcerts.html 
curl performs SSL certificate verification by default, using a "bundle" 
of Certificate Authority (CA) public keys (CA certs). If the default 
bundle file isn't adequate, you can specify an alternate file 
using the --cacert option. 
If this HTTPS server uses a certificate signed by a CA represented in 
the bundle, the certificate verification probably failed due to a 
problem with the certificate (it might be expired, or the name might 
not match the domain name in the URL). 
If you'd like to turn off curl's verification of the certificate, use 
the -k (or --insecure) option. 

Answer 1

你不解释，你所采取的试图解决这个问题是什么步骤，但这似乎是你没有把你的根证书放在correct location。

转到您安装放浪的目录中，找到该文件embedded\cacert.pem，然后你的企业证书的内容附加到文件中。保存并重试操作。如果您正确导出了根CA证书，则应该由Vagrant读取它们并允许连接。

如果您仍然无法通过合并文件使其工作，请尝试在环境中运行vagrant与SSL_CERT_FILE=/path/to/your/certs.pem。这将允许您验证您是否正确导出了您的公司证书。