1

I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out.

Somewhat simplified, I'm trying to do a POST request via https using Postman (later I'm hoping to reproduce it in PL/SQL under Oracle using UTL_HTTP), but I'm having some certificate-related issues. I have a specific url I'll be trying to reach later, but for testing purposes, I've been using a webhook url just to verify that I could make calls out at all.

I am able to perform a post request to a https-address if I disable SSL Certificate Verification under the Postman settings - so it's apparently possible to reach an outside url, so long as I don't care about the validity of the certificates used.

Proxy issues
I my problems are due to the fact that I'm behind a proxy at the organization I'm currently working for. If I look at the certificate path for the cert for webhook.site for instance, it looks like the following, where the grayed out parts of cert names are names related to the organization.

enter image description here

The result of this is that when I try to perform https POST requests to webhook without disabling cert verification, it fails with the following error shown in my Postman console:

Error: unable to verify the first certificate.

Attempted solutions
A couple of things I've experimented with to try to solve this:

  • Importing and adding any or all of the certs from the certification path shown above into my cert store.
  • Importing the certs into Postman (under Settings > Certificates) - although I'm far from certain that I've done this correctly, or if this is even the right way to go about it.

My hunch is that I just need to get the correct certificate installed in the correct place in order for this to work. The problem is I can't figure out which certificate that should be in this case (or where it should be installed for that matter, though I would assume that adding it under trusted root certificates in the system cert store should suffice?).

Are these assumptions correct? Any tips on how I can figure out exactly which certificate I'm actually missing?

Improve this question

1 Answer 1

Reset to default
1

The error is because the client - postman - cannot verify the server certificate. My assumption based on the information you provided is that your organization's proxy acts as a Man-In-The-Middle and terminates SSL at the proxy. As a result, you recieve a certificate signed by your organization rather than something signed by a trusted certificate authority.

The solutions to this is adding the signing authority as trusted CA on the client side.

Improve this answer
3
  • That matches my own theory pretty well. I assume what you mean is that I need to add the root cert from the cert path shown in the image as a trusted CA? I.e. add it to the Trusted Root Certificates under the Certificates snap-in in MMC? I've tried this, but not had any success so far, unfortunately. Please let me know if I've misunderstood what you meant here.
    – Kjartan
    Commented Jan 6, 2020 at 7:57
  • 2
    @Kjartan: Not every application is using the Windows trust store. Looks like postman is using its own and only recently added a way to import CA into this - see github.com/postmanlabs/postman-app-support/issues/3290
    – Steffen Ullrich
    Commented Jan 6, 2020 at 8:10
  • If the intention is just to verify whether adding the certificate eliminates the cert error, why don't you try it with curl and a custom cert bundle? A little googling would get you more details on how to do this.
    – hax
    Commented Jan 6, 2020 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .