IntelliJ: no suggestions due to self signed certificate

[DanielBednorz]

Hi there,

it is really frustrating. Since the demo-end-day I'm not able to get Copilot running again. The login issues seems to be gone, but now I dont get any suggestions. I've found this log:

WARN - #copilot - [ERROR] [default] [2022-09-08T09:15:19.606Z] Request Error: self signed certificate in certificate chain

I'm working in a Windows10-machine and behind a corporate network including proxy, certifcates and stuff.
Copilot version: 1.1.31.1908
IntelliJ IDEA: 2022.2.1

Does anyone has suggestions what I can do?

[iamcjwilliams]

Hello, @DanielBednorz Are you still experiencing this issue?

[DanielBednorz]

@iamcjwilliams
unfortunately yes. At the moment I have no idea what I can do

[knutwannheden]

I have the same issue. I don't even get the login dialog, just immediately the error. When I replace the core-1.1.31.jar with an older core-1.1.20.jar (as suggested elsewhere, which was a workaround that used to work), I at least get the login dialog. But nothing happens when I in the browser authorize the plugin. After that the error logs suggested that Azure Application Insights was missing (possibly due to the replaced jar), so I added that as well. With that the login appears to be working, but there are still no suggestions shown in the editor. I suppose I could try to downgrade to an earlier version where I did get it working with these hacks.

But frankly, I think this starts to get ridiculous. This is now a commercial tool (which I am already paying for!) but I cannot get it to work, because the company where I work uses self-signed certificates (which I of course have registered in the IntelliJ IDEA settings). The worst part about this is that I don't even know where to report this. The few discussions here on this topic don't seem like they have gotten much attention from GitHub.

@bmuskalla I think I have seen you replying to one of these discussions. Do you have some insight to share?

[iamcjwilliams]

@DanielBednorz @knutwannheden Our engineering team is looking into this issue

[tilmann1]

@DanielBednorz @knutwannheden Support for self-signed certificates is a known limitation in our current proxy support. We understand that there's a number of Copilot users that work in environments where this is a necessary requirement, that's why we have support for self-signed certificates on our radar and aim to implement the functionality in the future. We are unable to share a specific timeline for adding self-signed certificate support at this point in time.

I understand that this is probably not the answer you were looking for but I hope that it at least provides some extra context around the issue and the plans going forward. Thanks!

[SigmarEST]

@DanielBednorz @knutwannheden Support for self-signed certificates is a known limitation in our current proxy support. We understand that there's a number of Copilot users that work in environments where this is a necessary requirement, that's why we have support for self-signed certificates on our radar and aim to implement the functionality in the future. We are unable to share a specific timeline for adding self-signed certificate support at this point in time.

I understand that this is probably not the answer you were looking for but I hope that it at least provides some extra context around the issue and the plans going forward. Thanks!

Any updates on this?

[tilmann1]

@SigmarEST We have added proxy support for self-signed certificates now as part of the Copilot for Business offering, please have a look here: https://docs.github.com/en/copilot/troubleshooting-github-copilot/troubleshooting-certificate-errors-for-github-copilot

[masihtech]

One in line in the above doc says :"Properly install the proxy certificates on your machine in the OS trust chain."

My Question is for Java use can the proxy cert be added to JDK trust store and will that work?

[DuncanCasteleyn]

@SigmarEST We have added proxy support for self-signed certificates now as part of the Copilot for Business offering, please have a look here: https://docs.github.com/en/copilot/troubleshooting-github-copilot/troubleshooting-certificate-errors-for-github-copilot

Since that is no option for me, I have decided to cancel my subscription, I'm paying for as individual that should be my right, putting this hard block in the service means you are only reaching less customers.

[mails-199]

2022-11-09 15:42:41,444 [ 122025] WARN - #copilot - [ERROR] [default] [2022-11-09T07:42:41.436Z] Request Error: connect ETIMEDOUT 20.120.54.158:443
2022-11-09 15:42:41,445 [ 122026] WARN - #copilot - [ERROR] [ghostText] [2022-11-09T07:42:41.441Z] Error on ghost text request FetchError: connect ETIMEDOUT 20.120.54.158:443

[JamesBurtonBCM]

any further progress? There are stacks of developers working in this kind of environment..

[zerubeus]

Happy new year, any news on this?

[iamcjwilliams]

@zerubeus Have you tried troubleshooting steps: https://docs.github.com/en/copilot/troubleshooting-github-copilot/troubleshooting-certificate-errors-for-github-copilot

[lotek4u]

@iamcjwilliams , one of the steps to take is to configure VS code to ignore certificates. Since I work in a corporate environment with a proxy, like a lot of people, this looks like my only option. How do I set VS Code to ignore cert errors?

[zerubeus]

in my case, it is IntelliJ

[mazer-rakham]

So the answer is "Get co-pilot for business"? Not cool.

[caleb-pierce]

Adding my voice to this: Sign in failed. Reason: Request signIn Initiate failed with message: self signed certificate in certificate chain, request id: 3, error code: -32603

[tilmann1]

@caleb-pierce Support for self-signed certificates currently requires a Copilot for Business license (see https://docs.github.com/en/copilot/troubleshooting-github-copilot/troubleshooting-certificate-errors-for-github-copilot), are you on Copilot for Business? Thanks!

[siddharthgoel88]

I found a solution for this which works for me. Check this out https://sidd.io/2023/01/github-copilot-self-signed-cert-issue/

Fix :

1. Export the self-signed certificate in discussion
2. Convert it into .pem format if not already
3. Export the path of this .pem cert to NODE_EXTRA_CA_CERTS
4. Restart your Intellij and it should work

[siddharthgoel88]

Your company specific Cert Authority that would have been injected in by your company. Can find it in ‘Keychain Access’ in Mac for example

[zerubeus]

Or you can ask the service desk at your company to give you the cert, it ends up with .pem (if your company use confluence you can search for certification there as well)

[TheRedPandaDev]

Didn't work for me

[elyuty]

In order to find which certificate to use you can open e.g. github.com in Chrome and check the actual certificates (by clicking a little lock icon in the address bar). For me, it appeared to be a certificate of Kaspersky antivirus!

[sedrakpc]

Just want to add this will only work if you are at latest version of pycharm/Idea and latest version of copilot plugin. Please update before trying.

[pablomdo]

I managed to find a workaround to make Copilot work in a corporate network with IntelliJ on Ubuntu 20.04.
This might work for Pycharm and other IDEs as well, but I didn't check.

IntelliJ IDEA 2021.2
Copilot version 1.2.4.2459

All you have to do is create a local proxy server and configure IntelliJ to use it.

Here's a gist with the instructions on how to setup a Squid proxy server with Docker and Ubuntu, in case you don't know how:

https://gist.github.com/kryptogeist/3a9285a62744dde2b8e11973e02e0f3a