Failed to start copilot on centos 7 server

[luanft]

Select Topic Area

Bug

Body

I can use Copilot on on the centos 7 server for a year without any problem. Today Copilot doesn't work anymore. Below the logs. How to solve this problem?

2024-08-19 16:21:08.332 [warning] [certificates] Failed to parse certificate # ACCVRAIZ1
 Error: error:0480006C:PEM routines::no start line
    at new X509Certificate (node:internal/crypto/x509:119:21)
    at /home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:77:36
    at Array.filter (<anonymous>)
    at LR.removeExpiredCertificates (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:75:32)
    at LR.getAllRootCAs (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:66:38)
    at RO.createSecureContext (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/certificates.ts:46:23) {
  opensslErrorStack: [
    'error:0688010A:asn1 encoding routines::nested asn1 error',
    'error:06800066:asn1 encoding routines::bad object header',
    'error:0680009B:asn1 encoding routines::too long'
  ],
  library: 'PEM routines',
  reason: 'no start line',
  code: 'ERR_OSSL_PEM_NO_START_LINE'
}
2024-08-19 16:21:08.332 [info] [certificates] Removed 5 expired certificates
2024-08-19 16:22:04.197 [error] [auth] auth: FetchError: getaddrinfo EAI_AGAIN api.github.com
    at fetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/node_modules/@adobe/helix-fetch/src/fetch/index.js:99:11)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at cachingFetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/node_modules/@adobe/helix-fetch/src/fetch/index.js:288:16)
    at MO.fetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/helix.ts:93:22)
    at fetchCopilotToken (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/auth/copilotToken.ts:196:16)
    at authFromGitHubToken (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/auth/copilotToken.ts:129:22)
    at auth (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/extension/src/auth.ts:40:25)
    at authShowWarnings (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/extension/src/auth.ts:131:25)
    at mM.getCopilotToken (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/extension/src/auth.ts:174:33)
    at attemptAuthentication (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/extension/src/auth.ts:58:9) {
  type: 'system',
  _name: 'FetchError',
  code: 'EAI_AGAIN',
  errno: -3001,
  erroredSysCall: 'getaddrinfo'
}
2024-08-19 16:22:04.197 [error] [auth] getaddrinfo EAI_AGAIN api.github.com
2024-08-19 16:24:03.846 [error] [default] Error sending telemetry FetchError: getaddrinfo EAI_AGAIN copilot-telemetry.githubusercontent.com
    at fetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/node_modules/@adobe/helix-fetch/src/fetch/index.js:99:11)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at cachingFetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/node_modules/@adobe/helix-fetch/src/fetch/index.js:288:16)
    at MO.fetch (/home/users/luant/.vscode-server/extensions/github.copilot-1.223.0/lib/src/network/helix.ts:93:22) {
  type: 'system',
  _name: 'FetchError',
  code: 'EAI_AGAIN',
  errno: -3001,
  erroredSysCall: 'getaddrinfo'
}
2024-08-19 16:24:34.407 [error] [auth] Retrying auth

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[JohnFajardo]

Same error on Arch Linux:

2024-08-23 03:16:16.281 [warning] [certificates] Failed to parse certificate # ACCVRAIZ1
 Error: error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE
    at new X509Certificate (node:internal/crypto/x509:119:21)
    at /home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:77:36
    at Array.filter (<anonymous>)
    at LR.removeExpiredCertificates (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:75:32)
    at LR.getAllRootCAs (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:66:38)
    at RO.createSecureContext (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificates.ts:46:23) {
  opensslErrorStack: [
    'error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR'
  ],
  library: 'PEM routines',
  function: 'OPENSSL_internal',
  reason: 'NO_START_LINE',
  code: 'ERR_OSSL_PEM_NO_START_LINE'
}
2024-08-23 03:16:16.281 [warning] [certificates] Failed to parse certificate # ACCVRAIZ1
 Error: error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE
    at new X509Certificate (node:internal/crypto/x509:119:21)
    at /home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:77:36
    at Array.filter (<anonymous>)
    at LR.removeExpiredCertificates (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:75:32)
    at LR.getAllRootCAs (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificateReaders.ts:66:38)
    at RO.createSecureContext (/home/john/.vscode-oss/extensions/github.copilot-1.223.0/lib/src/network/certificates.ts:46:23) {
  opensslErrorStack: [
    'error:0c00006d:ASN.1 encoding routines:OPENSSL_internal:DECODE_ERROR'
  ],
  library: 'PEM routines',
  function: 'OPENSSL_internal',
  reason: 'NO_START_LINE',
  code: 'ERR_OSSL_PEM_NO_START_LINE'
}
2024-08-23 03:16:16.281 [info] [certificates] Removed 2 expired certificates
2024-08-23 03:16:16.564 [info] [fetcher] Using Helix fetcher.
2024-08-23 03:16:16.564 [info] [code-referencing] Public code references are enabled.
2024-08-23 03:16:16.565 [info] [auth] Sucessfully authenticated

[flyin]

@JohnFajardo Have you solved this problem without system certs editing?

[JohnFajardo]

No, I haven't solved it yet, I had to switch to Windows in this machine and to the insider/pre-release combo in another machine, neither solution is ideal. This is preventing me from switching back to Linux full time.

EDIT: I tried removing the offending certificate, but the problem keeps happening with whatever cert is next.

[szymonos]

Same error for me, Interestingly, no errors on Windows, but on remote WSL it throws similar error about one of the corporate proxy certificates I have installed in the WSL distro. What's more interesting I've disabled the proxy, so there is no connectivity issue.

Edit. I've removed this certificates, but it started complainig about another one, I've installed manually, this time publicly signed Globalsign one.

[Vikashchaurasiya07]

I think you guys should try these steps:

The logs you provided indicate two main issues with GitHub Copilot on your CentOS 7 server:

1. Certificate Parsing Error:

   Failed to parse certificate # ACCVRAIZ1
   Error: error:0480006C:PEM routines::no start line
   

   This error suggests there is a problem with parsing the SSL/TLS certificate used by Copilot. This could be due to a corrupted certificate or an issue with the certificate file.

2. DNS Resolution Failure:

   FetchError: getaddrinfo EAI_AGAIN api.github.com
   

   This error indicates that the server is having trouble resolving the DNS name api.github.com. This is typically a network-related issue.

Here are steps to address these issues:

1. Resolve Certificate Parsing Error

• Check Certificate Files: If you have control over the certificate files, ensure they are correctly formatted. Certificates should start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----. If they are corrupted or improperly formatted, you may need to replace or regenerate them.

• Reinstall/Update GitHub Copilot Extension: Try uninstalling and then reinstalling the GitHub Copilot extension in your editor. This might resolve issues related to corrupted or outdated certificate configurations.

• Check System Certificates: Ensure that your system's CA certificates are up-to-date. On CentOS, you can update CA certificates with:

  sudo yum update ca-certificates

2. Fix DNS Resolution Issues

• Check Network Connectivity: Ensure your server has a stable internet connection. Try pinging api.github.com to check connectivity:

  ping api.github.com

• Update DNS Configuration: Your server might be using outdated or incorrect DNS servers. You can update your DNS settings by editing /etc/resolv.conf to use a public DNS server like Google's (8.8.8.8):

  sudo nano /etc/resolv.conf

  Add or update the following line:

  nameserver 8.8.8.8
  

• Check Firewall and Proxy Settings: If you are using a firewall or proxy, ensure it allows traffic to GitHub's domains. Temporarily disable the firewall to see if it resolves the issue:

  sudo systemctl stop firewalld

• Clear DNS Cache: Sometimes DNS resolution issues can be resolved by clearing the DNS cache. Restarting the systemd-resolved service can help:

  sudo systemctl restart systemd-resolved

3. General Troubleshooting

• Restart the Editor: Sometimes restarting your code editor or IDE can clear temporary issues with extensions.

• Check System Time: Ensure your system clock is correct. Incorrect system time can sometimes cause issues with SSL/TLS certificates. You can synchronize your system clock with:

  sudo timedatectl set-ntp true

• Review System Logs: Look into /var/log/messages or /var/log/syslog for any additional clues related to network or certificate issues.

Conclusion

Address the certificate parsing issue first by checking the certificate files and updating the Copilot extension. For DNS resolution problems, ensure your network settings and DNS configuration are correct. If the problems persist after these steps, more specific details or reaching out to GitHub support might be necessary.

[luanft]

@flyin Seem it was a connection issue. I have tried to remove all data in .vscode-server directory on my server. Now the copilot is working again. but the certificate parser is still not working.

[belachkar]

I tried to ping ping api.github.com, I get: ping: api.github.com: Temporary failure in name resolution.
So I fixed using 2. Fix DNS Resolution Issues:

sudo nano /etc/resolv.conf
nameserver 8.8.8.8

[ilsubyeega]

Tried removing first line of ca-bundle.crt, ACCVRAIZ1, worked

[justdan96]

For anyone else having this issue, I had to update /usr/bin/update-ca-trust to remove the --comment option from the trust extract commands, and then run sudo update-ca-trust.

[daxisunder]

For anyone else having this issue, I had to update /usr/bin/update-ca-trust to remove the --comment option from the trust extract commands, and then run sudo update-ca-trust.

Thank you so much, those warnings suddenly started to spam the log and I spent over two hours debugging with Copilot Chat, nothing worked, but your solution worked like a charm.