UseDotNet@2 does fail with "self signed certificate in certificate chain"

Question, Bug, or Feature?: Bug Type: throws an error Enter Task Name: UseDotNet@2 (Version 2.0.5)

Environment

• Server - Azure Pipelines or TFS on-premises?

  • If using TFS on-premises, provide the version: Azure DevOps 2019 Update 1

• Agent - Hosted or Private:

  • If using private agent, provide the OS of the machine running the agent and the agent version: Agent 2.153.1 on a Win2012R2 6.3.9600 x64

Issue Description

I’ve configured the agent with --sslcacert [ca_cert_file].pem in order to prevent certificate errors during git checkout and other commands.

Step-Yaml

steps:
- task: UseDotNet@2
  displayName: 'Use dotnet sdk 2.x'
  inputs:
    version: 2.x

Task logs

2019-10-07T12:14:26.6273191Z Detected platform (Primary): win-x64
2019-10-07T12:14:26.6273853Z ##[debug]Got download URL for platform with rid: win-x64
2019-10-07T12:14:26.6280904Z ##[debug]
2019-10-07T12:14:26.6285086Z ##[debug]Agent.Version=2.153.1
2019-10-07T12:14:26.6286103Z ##[debug]Agent.TempDirectory=D:\S\_temp
2019-10-07T12:14:26.6289803Z ##[debug]testing directory 'D:\S\_temp'
2019-10-07T12:14:26.6310182Z Downloading: https://download.visualstudio.microsoft.com/download/pr/8ac3e8b7-9918-4e0c-b1be-5aa3e6afd00f/0be99c6ab9362b3c47050cdd50cba846/dotnet-sdk-2.2.402-win-x64.zip
2019-10-07T12:14:26.6311116Z ##[debug]destination D:\S\_temp\95b675f7-0775-44d8-bd62-e2ddcef043a3
2019-10-07T12:14:26.6311778Z ##[debug]downloading
2019-10-07T12:14:26.9935568Z ##[debug]task result: Failed
2019-10-07T12:14:27.0004484Z ##[error]Failed while installing version: 2.2.402 at path: D:\S\_tool/dotnet with error: Could not download installation package from this URL: https://download.visualstudio.microsoft.com/download/pr/8ac3e8b7-9918-4e0c-b1be-5aa3e6afd00f/0be99c6ab9362b3c47050cdd50cba846/dotnet-sdk-2.2.402-win-x64.zip Error: Error: self signed certificate in certificate chain
2019-10-07T12:14:27.0014547Z ##[debug]Processed: ##vso[task.issue type=error;]Failed while installing version: 2.2.402 at path: D:\S\_tool/dotnet with error: Could not download installation package from this URL: https://download.visualstudio.microsoft.com/download/pr/8ac3e8b7-9918-4e0c-b1be-5aa3e6afd00f/0be99c6ab9362b3c47050cdd50cba846/dotnet-sdk-2.2.402-win-x64.zip Error: Error: self signed certificate in certificate chain
2019-10-07T12:14:27.0035805Z ##[debug]Processed: ##vso[task.complete result=Failed;]Failed while installing version: 2.2.402 at path: D:\S\_tool/dotnet with error: Could not download installation package from this URL: https://download.visualstudio.microsoft.com/download/pr/8ac3e8b7-9918-4e0c-b1be-5aa3e6afd00f/0be99c6ab9362b3c47050cdd50cba846/dotnet-sdk-2.2.402-win-x64.zip Error: Error: self signed certificate in certificate chain
2019-10-07T12:14:27.0052967Z ##[section]Finishing: Use dotnet sdk 2.x

Task-Log

Investigations

usedotnet.ts calls VersionInstaller.downloadAndInstall(version, url); https://github.com/microsoft/azure-pipelines-tasks/blob/7e19e00ddb6f0e7f306bd9bf1dc8732c1d7ba0e1/Tasks/UseDotNetV2/usedotnet.ts#L70

That calls azure-pipelines-tool-lib/tool.downloadTool(downloadUrl): https://github.com/microsoft/azure-pipelines-tasks/blob/7e19e00ddb6f0e7f306bd9bf1dc8732c1d7ba0e1/Tasks/UseDotNetV2/versioninstaller.ts#L38

Which calls HttpClient.get(url): https://github.com/microsoft/azure-pipelines-tool-lib/blob/f9220e34b9aea8e4241fee20df2452e55142cb47/tool.ts#L231

And that finally calls info.httpModule.request: https://github.com/microsoft/typed-rest-client/blob/c99dbbeba106d4ca59b62a320923eed9b9a6c223/lib/HttpClient.ts#L328 where info.httpModule is either http or https defined at the top.

Here is the node documentation of that command: https://nodejs.org/api/https.html#https_https_request_options_callback

[damccorm]

Ah, missed that - we own that lib, that’s my mistake. With that said, I don’t think there’s a whole lot we can do about that. I think @Ausm provided a fine workaround for this though. My instinct is probably just to recommend using that.

[bishal-pdMSFT]

Makes sense. Closing the issue as there is a work around.