Allow Bypassing of SSL Cert Validation on Self-Hoster Runners

Describe the enhancement

Allow bypassing SSL certificate validation

Additional information

When a proxy server does SSL inspection, it does a sort of “man in the middle” action with certificates, such that the certs for github.com come back as being signed from an internal CA. Even when using the --sslskipcertvalidation flag, it reports:

[2020-01-16 15:54:33Z] System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

[H6LS1S]

export DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER=0

[ghost]

@Kremlin we were running into the same issues, and following @TingluoHuang by adding our certs to the linux ssl store did not work. What we found was by setting SSL_CERT_DIR to /etc/ssl/certs/ it then trusted our certs and we were able to configure the runner. Working on RHEL 7.7

I’m running into this on Ubuntu. Did you simply do SSL_CERT_DIR=/etc/ssl/certs within the terminal or within one of the Actions scripts? I tried with export but that didnt work for me.

We ended up getting network exceptions from our security team to stop doing their MITM cert inspection on our action runner for most things, so not sure how accurate my solution still is.

We were setting these in the actions workflow, for example on a step:

SSL_CERT_DIR: /etc/ssl/certs

Or for builtin steps that used node:

- name: Checkout
    uses: actions/checkout@v2
    env: 
      NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-bundle.crt

Where /etc/ssl/certs/ca-bundle.crt is the bundle that has our internal certs.

@deutmeyerbrianpfg has done a lot of work with our self hosted runners in our datacenter, he might be able to comment further.