Artifactory jfrog cli无法进行身份验证

Question

尝试使用jfrog cli与artifactory服务器集成时，收到以下错误

jfrog rt config example-company --url=$ARTIFACTORY_URL --user=$ARTIFACTORY_USER --password=$ARTIFACTORY_PASS
[Info] Encrypting password...
[Error] Get https://artifactory.example.com/api/security/encryptedPassword: x509: certificate signed by unknown authority

在浏览器中导航到https://artifactory.example.com/api/security/encryptedPassword会显示TLS证书是有效的，但是我得到一个不同的错误：

{
  "errors": [
    {
      "status": 404,
      "message": "User not found: bill.gates"
    }
  ]
}

ping命令也会返回TLS错误

jfrog rt ping --url=https://artifactory.example.com
[Error] Get https://artifactory.example.com/artifactory/api/system/ping: x509: certificate signed by unknown authority

jfrog cli是用golang编写的。运行版本：

go version
go version go1.12.5 darwin/amd64

看看jfrog github的问题，其他人也报告了类似的问题。

https://github.com/jfrog/jfrog-cli/issues/277

如何让jfrog cli连接到artifactory服务器？

Answer 1

这些错误是由错误配置的apache vhost引起的。由于证书链捆绑在证书中，因此不需要SSLCertificateChainFile。Web浏览器处理这种错误配置没有问题，但golang对链更有讲究。

错误的配置

  SSLCertificateFile      "/etc/ssl/certs/artifactory.example.com.crt.pem"
  SSLCertificateKeyFile   "/etc/ssl/private/artifactory.example.com.key.pem"
  SSLCertificateChainFile "/etc/ssl/certs/STAR.bad.example.com.pem"

工作配置

  SSLCertificateFile      "/etc/ssl/certs/artifactory.example.com.crt.pem"
  SSLCertificateKeyFile   "/etc/ssl/private/artifactory.example.com.key.pem"