Request Error: unable to get local issuer certificate

[lotek4u]

I've seen many people with this issue, but no full solutions posted. I'm working at an enterprise shop and we have proxys that perform SSL inspection. It's a fact of life. There is nothing I can do about... but I can put in bypass rules. I had our proxy team disable SSL inspection for https://vscode.dev/codeExchangeProxyEndpoints/github/login/oauth/access_token
which allowed me to activate the copilot extension, but I still can't use copilot.

[2022-10-21 08:20:04.801] [renderer1] [error] [Extension Host] [ERROR] [default] [2022-10-21T13:20:04.797Z] Request Error: unable to get local issuer certificate
[2022-10-21 08:20:04.801] [renderer1] [error] [Extension Host] [ERROR] [ghostText] [2022-10-21T13:20:04.797Z] Error on ghost text request FetchError: unable to get local issuer certificate

I have github auth extension enabled, my github and msft accounts are both active in Code, but copilot is failing with a cert error. I've uninstalled Code, removed the .vscode and %appdata% folders from my windows machine, reinstalled Code and just used those 2 extensions... still not working.

What exactly is the problem now? Is there another URL I need to disable SSL inspection with? It was difficult to even find that URL, it would be very helpful if someone documented what these errors mean and how to resolve them. Just saying "there is probably a VPN or something breaking it" does not help at all. What is the solution?

Thanks,
Nick

[iamcjwilliams]

@lotekjunky Thank you for your feedback, our copilot team is investigating this

[lotek4u]

Is there an update on this? I can't use it at work.

[lotek4u]

This morning, I tried copilot out again. I'm not longer getting the local issuer certificate error and copilot is giving me AI suggestions as designed. As far as I know, nothing has changed on my side, but it's working now.

[lotek4u]

Hey, it's broken again. Worked fine last week, nothing changed on my side... copilot activation is disabled again.

[iamcjwilliams]

@lotekjunky can you provide a screenshot of the error you're receiving by performing the following: (View -> Output; select GitHub Copilot from the pulldown)

[lotek4u]

Here you go @iamcjwilliams :
https://imgur.com/a/Mh00re1

[ERROR] [default] [2022-11-01T13:26:29.021Z] GitHub Copilot could not connect to server. Extension activation failed: "unable to get local issuer certificate"

[iamcjwilliams]

The error message unable to get local issuer certificate means a proxy that uses self-signed certificates is being used. Unfortunately, self-signed certificate is something we currently don't have support for but will soon. I recommend that you keep an eye on our official GitHub public product roadmap, our Changelog, and our GitHub Blog for future updates.

[lotek4u]

thank you @iamcjwilliams . I will keep an eye on that. However, I had this working at work last week... and I have the ability to put in SSL bypass for certain URLs in the corporate proxy. I just can't find what needs to be bypassed. I was able to get github authentication working, but the copilot activation is what's failing "obviously."

[chuklee]

Hello any news on this subject, i have the same error :/

[hem4n7]

cancelling the subscription,

[FarisAhmed]

@lotekjunky That is not true, I managed to make it work with Visual Studio 2022 Enterprise behind Zscaler on my corporate notebook

[Shurid]

Where do I find these proxy settings in Visual Studio 2022?

[FarisAhmed]

You don't need to change any proxy settings. Just follow the steps in my post. It worked for me and for many others too

[Shurid]

Thanks it worked.

[nklsla]

Think I got it working. I'm behind company proxy and these are my settings I believe are relevant:

    "github.copilot.advanced": {
        "authProvider": "github"
    },
    "http.proxySupport": "on",
    "http.proxy": "http://<company-url>:<port>",
    "http.proxyStrictSSL": false,

When I changed http.proxyStrictSSL to false the local issure certificate problem was resolved.

Also worth mentioning is that I've marked Copilot as Trusted in Manage Trusted Extensions in my github profile in Vscode (found at the bottom left where you activate settings sync)
@hem4n7 @lansalot @lotekjunky @chuklee

[Depechie]

This worked for me too!

[marco-kasl]

Thanks @nklsla!
It worked perfectly for me!

[Shurid]

With FarisAhmed solution I was able to solve certification issue but still having corporate proxy issue. If I disconnect VPN everything works but with VPN it gives error: Error while processing the event: The proxy tunnel request to proxy 'http://xxxx/' failed with status code '407'." Where do I find the setting file to update as you have stated above? I am not able to locate the settings that needs the change to resolve.

[nklsla]

I had that issue for the Chat-function, but if I remember correctly it got solved when I updated vs code to the latest version.

[lotek4u]

I decided to resubscribe and tested this out and it actually worked! Thanks @marco-kasl ! I'm having issues with the chat still doing the same thing, but I can live with that for now I guess...

[ManuelYepiz]

Hi, I appreciate your help @nklsla, I was unable to apply your suggestion, as I didn't get it to be honest v: haha, but I got this suggestion from a coworker that fixed it for me:

"Please, try this:
set NODE_EXTRA_CA_CERTS system environment variable to refer to your git certificate bundle file, usually ‘c:\Program Files\Git\mingw64\etc\ssl\certs\ca-bundle.trust.crt’
(this demands git installed on your computer)"

For anyone not familiar with this menu:

Then just fill the boxes with NODE_EXTRA_CA_CERTS & the Path.

Hopefully this is useful for others, I can get suggestions now by adding a comment prior to the line where I want the code:

Regards.

[angelhortelano]

This worked perfectly for me, thank you very much

[lotek4u]

This one didn't work for me. I could never make VS Code care about the fact that I added a new ENV variable. It's up to you if you want to provide more info, but it might help others later... it would be very useful to see your Github Copilot Output box and/or Copilot config section of settings.json

[JSantas]

If you are using copilot with zscaler, this could help with unable to get local issuer cert

[meChiel]

Hey,
I am trying to use using copilot with zscaler. And I am having the "unable to get local issuer cert" issue.
So I am interested in this solution to make it work. But I am unable to find the settings dialogue box you show.
Where, in what program, how do you find these settings?

[mawax]

Looks like IntelliJ. But similar settings can be found in Visual Studio Code

[FarisAhmed]

I managed to make my 30 days free trial CoPilot work in Visual Studio 2022 on Windows behind Zscaler as follows:

• Browse with chrome to https://copilot-proxy.githubusercontent.com/v1/engines/copilot-codex then export the Zscaler Root CA as shown below to file C:\Data\CoPilot\CA\Zscaler Root CA.pem
  

• Define new user environment variable NODE_EXTRA_CA_CERTS and set its value to the Zscaler certificate file

• Restart Visual Studio