配置Vagrant CA证书

Question

我在公司代理服务器和自签名CA证书后面执行Vagrant命令时遇到问题。我已经配置了环境变量HTTP_PROXY、HTTPS_PROXY和HTTP_NO_PROXY变量。

我有一个包含所有公司证书的Java密钥库。我已经使用了-exportcert命令的-exportcert选项和许多选项。我还使用了openssl命令和许多选项，并将生成的文件放在Vagrant安装的嵌入式Ruby目录中的多个位置，但都没有成功。

我读过很多网站，其中包含有关配置Ruby和curl的信息，但还没有成功地让Vagrant命令工作。我找到的所有帖子都集中在Ruby和curl选项上，我不知道如何在Vagrant中使用这些选项，Vagrant包含了Ruby作为Vagrant的嵌入式组件。

Windows 7上的Vagrant 1.9.5

Vagrant安装目录C:\Apps\Vagrant\

C:\WorkArea> vagrant plugin install vagrant.proxyconf

ERROR:  SSL verification error at depth 3: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (/C=US/O=xxx xxx/OU=xxx xxx Certification Authority/CN=xxx xxx Root Certification Authority 01 G2)  
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://api.rubygems.org/specs.4.8.gz)

C:\WorkArea> vagrant up

Bringing machine 'default' up with 'virtualbox' provider...
==> default: Box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found. Attempting to find and install...
    default: Box Provider: virtualbox
    default: Box Version: >= 0
The box 'puppetlabs/ubuntu-16.04-64-puppet' could not be found or
could not be accessed in the remote catalog. If this is a private
box on HashiCorp's Atlas, please verify you're logged in via
`vagrant login`. Also, please double-check the name. The expanded
URL and error message are shown below:
URL: ["https://atlas.hashicorp.com/puppetlabs/ubuntu-16.04-64-puppet"]
Error: SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

Answer 1

您没有解释您采取了哪些步骤来尝试解决这个问题，但是看起来您并没有将根证书放在correct location中。

转到您安装Vagrant的目录，找到文件embedded\cacert.pem，然后将公司证书的内容附加到该文件。保存它，然后重试该操作。如果您正确地导出了根CA证书，那么Vagrant应该会读取它们并允许连接。

如果您仍然无法通过组合这些文件来使其工作，请尝试在环境中使用SSL_CERT_FILE=/path/to/your/certs.pem运行vagrant。这将允许您验证是否已正确导出公司证书。