REST request failed: error getting server certificate.

[kodekage]

I have been trying to install the windows-installer version on my local machine running on a windows 7 OS. I have been getting this error message each time I try to install the CLI tool.

[rpottsoh]

Sorry to learn you have difficulties. Is REST request failed: error getting server certificate. the complete message you are seeing? Is there anything else being reported you could share with me? HOw is the error message being presented, in a pop-up window?

[kodekage]

That's the complete error message.

[rpottsoh]

Let me know what you see if you enter the following url into your web browser:
https://api.github.com/repos/exercism/cli/releases/latest

You should receive a bunch of JSON or you might get the error message.

[kodekage]

The link actually contains a bunch of JSON like you said.

[rpottsoh]

@OPARA-PROSPER I am unable to reproduce the error you have described. Make sure you are executing the installer as Administrator, if you have not tried this already.

The latest version of the CLI may be downloaded from here.

Setup the CLI manually. Configuration instructions can be found after scroll past the chocalatey instructions.

I'll leave this issue open for the time being. If you need help manually setting up the CLI please don't hesitate to ask for help.

If there is any more information you can provide about how the installer is being called, that might help me get to the bottom of the problem you are having, I would appreciate it.

Did you just recently download the installer? Just making sure you are using the latest version.

[kodekage]

I tried setting up manually and it worked, thanks for the feedback.

[rpottsoh]

@acgoncu I noticed your post on gitter regarding an issue with the Windows CLI installer. Thanks for the screen image. Are you using what version of Windows are you using?

[rpottsoh]

I can recreate this problem in Windows 7 but not in Windows 10. But what is even more disturbing is the previous version of the installer, 1.4.0, released last August, that I tested on Windows 7, also exhibits the same symptom. The 1.4.0 installer has not changed. Has something on GitHub changed?

[NobbZ]

Perhaps some certifiactes have been replaced by certificates which sign chain can't be properly verified until its root certificate and is therefore considered untrusted?

I'm not sure if Windows 7 got the newest updates on certificates.

I'm not even sure if one can update those in Windows by hand.

[rpottsoh]

All good questions. This is a very annoying issue to say the least. Chrome and IE Web browsers on Win 7 will receive the JSON response. The version of the installer that I published was developed on a win 7 machine and worked fine then (I am referring to the previous release from last August). Now the same release doesn't work on the same machine. There could be something to what you suggest, I don't know how to deal with that scenario, yet. Thanks for the comment. Sent from my android device.

…

-----Original Message----- From: Norbert Melzer <[email protected]> To: exercism/windows-installer <[email protected]> Cc: Ryan Potts <[email protected]>, State change <[email protected]> Sent: Mon, 19 Mar 2018 7:09 AM Subject: Re: [exercism/windows-installer] REST request failed: error getting server certificate. (#33) Perhaps some certifiactes have been replaced by certificates which sign chain can't be properly verified until its root certificate and is therefore considered untrusted? I'm not sure if Windows 7 got the newest updates on certificates. I'm not even sure if one can update those in Windows by hand.

-- You are receiving this because you modified the open/close state. Reply to this email directly or view it on GitHub: #33 (comment)

[acgoncu]

I have Windows 7. I tried the Aug '17 and the Dec '17 installers, and both prompted the error message.

[rpottsoh]

This is what I have discovered as well. Back in August it worked on Windows 7, but not today. The installer does work fine in Windows 10. I'll get this figured out eventually. Let me know if you have any issues or questions regarding installing the CLI manually as @NobbZ recommended on Gitter.

[NobbZ]

By accident I stumbled over a similar problem with rusts version manager rustup, there have been reports that their problem have been solved by some registry hackery.

Perhaps it is related and fixing the TLS version as described in this MS article does help?

https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-a-default-secure-protocols-in

Background:

Github recently removed support for some older TLS versions, which older Windows defaults to. You have to change the default version to a more modern TLS version to make it work again.

[rpottsoh]

Github recently removed support for some older TLS versions, which older Windows defaults to. You have to change the default version to a more modern TLS version to make it work again.

Thanks @NobbZ this is the sort of information I have looking for to rationalize why something I compiled last August, that worked, now no longer works.

I think it is not enough to just upgrade ones installation of Windows, I think the application may also need to be updated to utilize the changes as well. The latest version of Delphi 10.2.3 (released a few days ago) I learned yesterday has updates included in its libraries related to HTTP & REST.

I scanned though the support DOC for the link you provided and it appears like it could be a couple of years old at least. So I think the recent changes GitHub has made is what has triggered the present issue with the CLI installer. It would seem that this has been a sleeping issue that has awoken.

I will be installing 10.2.3 in a few days and will rebuild the installer to see if that helps.

@NobbZ would you direct me to where GitHub talks about dropping support for older TLS versions? I may want to relay this information to Embarcadero (makers of Delphi and C++ Builder).

At the very least I think I need to update my release notes for the Installer that it may not work for Windows 7 users.. 🤕

[NobbZ]

https://blog.github.com/2018-02-23-weak-cryptographic-standards-removed/

So yes, this is a very recent change on githubs side, barely a month ago.

[rpottsoh]

Thanks @NobbZ. I was not aware. My work on the Installer started in July last year. In hindsight it would have been nice if the REST response from api.github.com included a blurb regarding using a soon to be unsupported security protocol, if one was being used....

[rpottsoh]

Follow these instructions if you are running windows version earlier than version 10. You need to download and execute MicrosoftEasyFix51044.msi, follow the Easy Fix instructions towards the bottom of the page. This will make the necessary changes to the Windows registry in order for windows to default to the TLS 1.1 and 1.2 protocol, instead of 1.0 and 1.1. Github recently dropped support for the 1.0 and 1.1 protocol.

The Windows Installer for the CLI should work fine after making these changes to Windows.

[rpottsoh]

@OPARA-PROSPER and @acgoncu if you are willing would you mind attempting the fix I described in my previous comment? The fix has worked on my Windows 7 system, likely it will as well on yours. I would just like to have more than my system to go by before I update the release notes for the Windows CLI Installer. Let me know if you have any questions.

[rpottsoh]

I have released an update to the CLI Installer that addresses this issue. The installer will detect if there is an issue and advise the user to what actions need to be taken to make their system compatible.
https://github.com/exercism/windows-installer/releases/tag/v1.4.2