配置Vagrant CA证书

Question

我在公司代理服务器和自签名CA证书后面执行Vagrant命令时遇到问题.我已配置环境变量HTTP_PROXY,HTTPS_PROXY和HTTP_NO_PROXY变量.

我有一个包含所有公司证书的Java密钥库.我使用了keytool命令的-exportcert选项和许多选项.我已经使用了openssl命令以及许多选项,并将生成的文件放在Vagrant安装中的嵌入式Ruby目录中的多个位置,但没有任何成功.

我已经阅读了很多网站,其中包含有关配置Ruby和curl的信息,但在获取Vagrant命令方面没有任何成功.我找到的所有帖子都集中在Ruby和curl选项上,我不明白如何利用Vagrant,包括Ruby作为Vagrant的嵌入式组件.

请提供有关如何从Java密钥库正确导出证书的说明,并可选择转换它们并放置生成的文件,以便Vagrant能够成功地通过公司代理与Internet进行通信.

Windows 7上的Vagrant 1.9.5

Vagrant安装目录C:\ Apps\Vagrant \

C:\WorkArea> vagrant plugin install vagrant.proxyconf

ERROR:  SSL verification error at depth 3: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (/C=US/O=xxx xxx/OU=xxx xxx Certification Authority/CN=xxx xxx Root Certification Authority 01 G2)  
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://api.rubygems.org/specs.4.8.gz)

C:\WorkArea> vagrant up

Bringing machine 'default' up with 'virtualbox' provider...
==> default: Box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found. Attempting to find and install...
    default: Box Provider: virtualbox
    default: Box Version: >= 0
The box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found or
could not be accessed in the remote catalog. If this is a private
box on HashiCorp's Atlas, please verify you're logged in via
`vagrant login`. Also, please double-check the name. The expanded
URL and error message are shown below:
URL: ["https://atlas.hashicorp.com/puppetlabs/ubuntu-16.04-64-puppet"]
Error: SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

Answer 1

您没有解释为尝试解决问题所采取的步骤,但似乎您没有将根证书放在正确的位置.

转到安装Vagrant的目录,找到该文件embedded\cacert.pem,然后将公司证书的内容附加到该文件.保存并重试该操作.如果您正确导出了根CA证书,则应由Vagrant读取它们并允许连接.

如果您仍然无法使其通过结合文件的工作,尝试运行vagrant与SSL_CERT_FILE=/path/to/your/certs.pem环境.这将允许您验证您是否已正确导出公司证书.