-
Notifications
You must be signed in to change notification settings - Fork 299
Automatic import of private CA certificates in Windows.#3441
Conversation
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.
I have read the CLA Document and I hereby sign the CLA
CULOT CÉSAR seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.
@RemiBou
RemiBou
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
add tests
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
add tests
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why do we need to persist the chain ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Go on Windows can validate a certificate against the CAs available in the Windows certificate store (typically managed by a corporate PKI team).
If the connection is successfully validated by Go, we can safely extract and copy the certificate chain into the location expected by JFrog CLI (~/.jfrog/security/certs).
This approach avoids a full rewrite of the CLI to directly support the Windows certificate store. Instead, it preserves the existing mechanism (manual placement of private CA certificates), while leveraging Go’s ability to interact with the system certificate store to ensure the chain we import is trusted.
RemiBou
commented
Apr 16, 2026
It should be handled in https://github.com/jfrog/jfrog-client-go/blob/master/auth/cert/sslutils_windows.go
Even better, we have a 5 lines fix then
https://github.com/jfrog/jfrog-client-go/blob/master/auth/cert/loader.go
replace:
caCertPool, err := loadSystemRoots()
with:
caCertPool, err := x509.SystemCertPool()
if caCertPool == nil {
caCertPool = x509.NewCertPool()
}
Tested locally.
might be a fix for : #2309
Summary
This PR adds a Windows-specific preflight step to improve handling of private PKI certificates in JFrog CLI.
When a command includes a target URL, the CLI:
~/.jfrog/security/certs
Motivation
On Windows, JFrog CLI may fail with:
even when the certificate is already trusted by the OS.
Manually exporting the site certificate from a browser and placing it in
~/.jfrog/security/certsresolves the issue.This patch automates that process.
Behavior
--urlorJFROG_URLis providedTesting
Validated locally: