CLI: Disabling SSL certificate check & importing custom CA

[mwllgr]

Hello,

I'm behind a corporate firewall and try to create a new Quarkus project using CLI.
However, as the Firewall is doing DPI and replaces the certificate by a self-signed one, the registry can't be contacted:

user@host:~/code$ quarkus create --verbose
Creating an app (default project type, see --help).
[DEBUG] Creating a new project with initial parameters: CreateApp{gav=TargetGAVGroup [groupId=org.acme, artifactId=code-with-quarkus, version=1.0.0-SNAPSHOT, gav=null], quarkusVersion=TargetQuarkusVersionGroup{stream=null, platformBom=null}, targetBuildTool=TargetBuildToolGroup [gradle=false, gradleKotlinDsl=false, jbang=false, maven=false], targetLanguage=TargetLanguageGroup [java=<<detect java runtime version>>, kotlin=false, scala=false, sourceType=null], codeGeneration=CodeGenerationGroup [includeCode=true, includeWrapper=true, packageName=null], extensions=[], name=null, description=null, project=BaseCreateCommand [outputPath=null, registryClient=RegistryClientMixin [useRegistryClient=true], projectDirName=null, projectRootPath=null, targetDirectory=null, values={}], data={}, properties={}}
[DEBUG] Creating an app using the following settings: {project.artifact-id=code-with-quarkus, project.extensions=[], codegen.no-buildtool-wrapper=false, data={}, project.group-id=org.acme, project.app-config={}, codegen.no-code=false, project.version=1.0.0-SNAPSHOT, project.java-version=17}
[DEBUG] Resolving Quarkus extension catalog for TargetQuarkusVersionGroup{stream=null, platformBom=null}
[WARN] 🔥  Configured Quarkus extension registries appear to be unavailable at the moment. It should still be possible to create a project by providing the groupId:artifactId:version of the desired Quarkus platform BOM, e.g. 'quarkus create -P io.quarkus.platform:quarkus-bom:3.2.4.Final'
[ERROR] ❗  Unable to create project: Failed to resolve the Quarkus extension registry descriptor of registry.quarkus.io from registry.quarkus.io (https://registry.quarkus.io/maven)

Is there a way to...

1. Disable the certificate check
2. Set the Options = UnsafeLegacyRenegotiation value for OpenSSL (if used)
3. Import a custom root certificate for the CLI

I already tried these options:

• -Dmaven.wagon.http.ssl.insecure=true
• -Dquarkus.tls.trust-all=true

Thanks!

[quarkus-bot[bot]]

/cc @ebullient (cli), @evanchooly (kotlin), @geoand (kotlin), @maxandersen (cli,jbang), @quarkusio/devtools (jbang)

[mwllgr]

And for further information, the stack trace:

io.quarkus.registry.RegistryResolutionException: Failed to resolve the Quarkus extension registry descriptor of registry.quarkus.io from registry.quarkus.io (https://registry.quarkus.io/maven)
        at io.quarkus.registry.client.maven.MavenRegistryClientFactory.buildRegistryClient(MavenRegistryClientFactory.java:91)
        at io.quarkus.registry.ExtensionCatalogResolver$Builder.buildRegistryClients(ExtensionCatalogResolver.java:121)
        at io.quarkus.registry.ExtensionCatalogResolver$Builder.build(ExtensionCatalogResolver.java:90)
        at io.quarkus.devtools.project.QuarkusProjectHelper.getCatalogResolver(QuarkusProjectHelper.java:166)
        at io.quarkus.devtools.project.QuarkusProjectHelper.getCatalogResolver(QuarkusProjectHelper.java:152)
        at io.quarkus.cli.registry.RegistryClientMixin.getExtensionCatalogResolver(RegistryClientMixin.java:118)
        at io.quarkus.cli.registry.RegistryClientMixin.getExtensionCatalog(RegistryClientMixin.java:91)
        at io.quarkus.cli.registry.RegistryClientMixin.createQuarkusProject(RegistryClientMixin.java:60)
        at io.quarkus.cli.create.BaseCreateCommand.build(BaseCreateCommand.java:222)
        at io.quarkus.cli.CreateApp.call(CreateApp.java:81)
        at io.quarkus.cli.CreateApp.call(CreateApp.java:22)
        at picocli.CommandLine.executeUserObject(CommandLine.java:2041)
        at picocli.CommandLine.access$1500(CommandLine.java:148)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
        at picocli.CommandLine.execute(CommandLine.java:2170)
        at io.quarkus.cli.Create.call(Create.java:35)
        at io.quarkus.cli.Create.call(Create.java:12)
        at picocli.CommandLine.executeUserObject(CommandLine.java:2041)
        at picocli.CommandLine.access$1500(CommandLine.java:148)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
        at picocli.CommandLine.execute(CommandLine.java:2170)
        at io.quarkus.cli.QuarkusCli.run(QuarkusCli.java:131)
        at io.quarkus.cli.QuarkusCli_ClientProxy.run(Unknown Source)
        at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:132)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:71)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:44)
        at io.quarkus.cli.Main.main(Main.java:9)
Caused by: io.quarkus.bootstrap.resolver.maven.BootstrapMavenException: Failed to resolve artifact io.quarkus.registry:quarkus-registry-descriptor:json:1.0-SNAPSHOT
        at io.quarkus.bootstrap.resolver.maven.MavenArtifactResolver.resolveInternal(MavenArtifactResolver.java:169)
        at io.quarkus.bootstrap.resolver.maven.MavenArtifactResolver.resolve(MavenArtifactResolver.java:154)
        at io.quarkus.registry.client.maven.MavenRegistryArtifactResolverWithCleanup.resolveAndCleanupOldTimestampedVersions(MavenRegistryArtifactResolverWithCleanup.java:76)
        at io.quarkus.registry.client.maven.MavenRegistryClientFactory.buildRegistryClient(MavenRegistryClientFactory.java:85)
        ... 34 more
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: The following artifacts could not be resolved: io.quarkus.registry:quarkus-registry-descriptor:json:1.0-SNAPSHOT (absent): Could not transfer artifact io.quarkus.registry:quarkus-registry-descriptor:json:1.0-SNAPSHOT from/to registry.quarkus.io (https://registry.quarkus.io/maven): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:459)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:259)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:242)
        at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveArtifact(DefaultRepositorySystem.java:277)
        at io.quarkus.bootstrap.resolver.maven.MavenArtifactResolver.resolveInternal(MavenArtifactResolver.java:164)
        ... 37 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact io.quarkus.registry:quarkus-registry-descriptor:json:1.0-SNAPSHOT from/to registry.quarkus.io (https://registry.quarkus.io/maven): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:44)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:417)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:260)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:522)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:435)
        ... 41 more
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
        at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
        at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
        at org.eclipse.aether.transport.http.HttpTransporter.execute(HttpTransporter.java:393)
        at org.eclipse.aether.transport.http.HttpTransporter.implGet(HttpTransporter.java:343)
        at org.eclipse.aether.spi.connector.transport.AbstractTransporter.get(AbstractTransporter.java:64)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:482)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:414)
        ... 44 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
        at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
        at java.base/sun.security.validator.Validator.validate(Validator.java:264)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
        ... 71 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:127)
        at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
        at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
        ... 76 more

[bulldog98]

The quarkus cli tool is a jar, so you should be able to build your own truststore containing the ca certificat and set it via the normal java methods.

[mwllgr]

Alright, thanks!