3

I work for a large corporation that uses Blue Coat as the proxy server. This causes the proxy server to intercept all SSL traffic, then reissues a new certificate to browser from the server itself.

The problem I'm facing is that whenever developer tools download resources via SSL, every certificate fails validation. I suspect this is caused by our Blue Coat proxy. The tools in question are pip (Python's package manager) and npm (Node's package manager). Lucky for me they both accept a client certificate in PEM format.

My current undesired solution is to disable SSL across the board.

What specifically do I need to ask from my IT department in order to validate third-party certificates in this instance?

PS C:\dev> pip install e -v
Collecting e
  Getting page https://pypi.python.org/simple/e/
  Starting new HTTPS connection (1): pypi.python.org
  Could not fetch URL https://pypi.python.org/simple/e/: connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certific
verify failed (_ssl.c:600) - skipping
  1 location(s) to search for versions of e:
  * https://pypi.python.org/simple/e/
  Getting page https://pypi.python.org/simple/e/
  Starting new HTTPS connection (2): pypi.python.org
  Could not fetch URL https://pypi.python.org/simple/e/: connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certific
verify failed (_ssl.c:600) - skipping
  Could not find a version that satisfies the requirement e (from versions: )
Cleaning up...
No matching distribution found for e
Exception information:
Traceback (most recent call last):
  File "c:\dev\pypi\lib\site-packages\pip\basecommand.py", line 211, in main
    status = self.run(options, args)
  File "c:\dev\pypi\lib\site-packages\pip\commands\install.py", line 305, in run
    wb.build(autobuilding=True)
  File "c:\dev\pypi\lib\site-packages\pip\wheel.py", line 705, in build
    self.requirement_set.prepare_files(self.finder)
  File "c:\dev\pypi\lib\site-packages\pip\req\req_set.py", line 334, in prepare_files
    functools.partial(self._prepare_file, finder))
  File "c:\dev\pypi\lib\site-packages\pip\req\req_set.py", line 321, in _walk_req_to_install
    more_reqs = handler(req_to_install)
  File "c:\dev\pypi\lib\site-packages\pip\req\req_set.py", line 461, in _prepare_file
    req_to_install.populate_link(finder, self.upgrade)
  File "c:\dev\pypi\lib\site-packages\pip\req\req_install.py", line 250, in populate_link
    self.link = finder.find_requirement(self, upgrade)
  File "c:\dev\pypi\lib\site-packages\pip\index.py", line 571, in find_requirement
    'No matching distribution found for %s' % req
pip.exceptions.DistributionNotFound: No matching distribution found for e
  • Tried these? SO, SU, Reddit – StackzOfZtuff Nov 27 '15 at 15:10
  • I have. It's not a HTTP proxy issue as I've already configured everything, which is how I'm able to download things using pip and npm without SSL in the first place. Secondly, using curl.haxx.se/ca/cacert.pem does not successfully help in validation. – onetwothree Nov 27 '15 at 15:20
3

Bluecoat and other firewalls do SSL interception to analyze HTTPS traffic for malware too. To do this they create a HTTPS connection between the firewall and the server and a new HTTPS connection between the client and the firewall. Of course this new connection can not have the original certificate of the server, since the firewall does not have access to the private key of the server. This means that the firewall will create a new certificate signed by a CA at the firewall.

To validate this new certificate the client has to trust the proxy CA of the firewall. Usually this is done by adding this CA as trusted to all computers inside the company. But, different applications use different trust stores and this certificate is usually only added to the OS specific trust store, which means that in Windows only IE and Chrome will automatically trust the proxy CA. For any other applications you need to explicitly add the CA as trusted. How this is done depends on the application but for pip you might find help at this question.

3

How can I validate the authenticity of SSL certificates when company uses Blue Coat?

You can't. Blue Coat eats it and replaces it with one of it's own.

You could try to ask your admins to implement proxy rule that excludes https://pypi.python.org from inspection.

3

BlueCoat works in your company's desktop browsers because your IT department has loaded an extra Trusted Root Authority certificate into your systems certificate stores (with Windows that's commonly done via Group Policy.) This certificate is the one that validates your BlueCoat's certificates are trustworthy, allowing you to surf to https sites without seeing a 'bad certificate' warning.

Python's installer doesn't look in the system certificate store. It has its own list of certificates. What you need to do is tell pip to trust your company's root certificate, too.

Get a copy of your company's BlueCoat root certificate. One way you might find it is to see if your company has a special link to "install this certificate in Firefox"; that link should point to the exact certificate you need. Download a copy to your machine, then set it in your pip configuration file $HOME/.pip/pip.conf like this:

[global]
cert = /usr/local/share/ca-certificate/bluecoat_proxy.crt

Sorry I don't have info on configuring npm to trust an additional certificate; check the docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.