ERR_CERT_AUTHORITY_INVALID when launching nRF Connect for Desktop

[David C.]

I am attempting to install the nRF Connect SDK in a Linux VM (Ubuntu 22.04), hosted on a Windows 10 laptop.  The Windows environment has a network security suite (ZScaler), which intercepts all HTTPS communication for validation.  As a part of this, inbound HTTPS traffic is always signed with a ZScaler ceritificate.

In order to make this work, I have installed ZScaler's root certificate in my VM, both for Linux (via the update-ca-certificates command) and in my web browser (Firefox, via its menus).

When I try to run the nRF Connect installer (nrfconnect-3.12.0-x86_64.appimage), however, I see the following error:

Unable to download latest app info: Unable to download apps list: Unable to download https://developer.nordicsemi.com/.pc-tools/nrfconnect-apps/apps.json: net::ERR_CERT_AUTHORITY_INVALID. If you are using a proxy server, you may need to configure it as described on https://github.com/NordicSemiconductor/pc-nrfconnect-launcher

I think this error is happening because the nRF Connect installer's embedded Chrome browser doesn't see the ZScaler ceritifcate.  How can I configure it to use this certificate?  Either by using the one I installed system-wide for Linux or by explicitly installing it in its embedded Chrome configuration?

Or does this mean I can not use nRF Connect for Desktop in this VM, and should instead manually install the nRF Connect SDK software?

[Priyanka]

Hi David,

I am onto this. Have you looked into the requirements for the OS before installation of nRF Connect SDK? https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/gs_recommended_versions.html#gs-recommended-versions 

Best Regards,

Priyanka

[David C.]

I was able to manually install the entire SDK, and it works, so I don't think Ubuntu 22.04 is the cause.

I've experienced this problem with other products (e.g. compiling TensorFlow Lite via its "bazel" tool), and the solution has always been to install the ZScaler certificate into a place where the tool's HTTPS stack can find it.

I'm sure the solution here will be similar, but I don't know what the correct place for installation might be.

[Priyanka]

Hi David,

Could you verify whether you can see https://developer.nordicsemi.com/.pc-tools/nrfconnect-apps/apps.json from a browser on the Ubuntu VM?

-Priyanka

[David C.]

Yes.  I can get that file, both from within Firefox and via the "wget" command.

In both cases, I have installed the ZScaler root certificate, which is why it works there.

[Priyanka]

Hi David,

We will try to reproduce this on our end and will get back to you.

-Priyanka

[Priyanka]

Could you try using --ignore-certificate-errors when starting the app from CLI on LINUX and see if this resolve the issue.

Also a more secure solution would be to:

• `sudo apt-get install libnss3-tools`
• `certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "<SOME_FRIENDLY_NAME>" -i <PATH-TO-CA-CRT>/<CRT-FILE-NAME>.pem`
• Start nrfconnect

-Priyanka

[David C.]

Yes.  Both of those options work.  Thanks for your help.  Please add this information to the installation instructions on the web page so others will know about it.

[Priyanka]

Sure. :) Glad to hear that it works. Thank you for your feedback.

-Priyanka