Remove the requirement to install a root certificate

[sosnik]

Can the VS Code extension work (or be forced to work) without installing a random root certificate on my machine?

This extension is targeted towards developers. Developers will be acutely aware of the security implications of installing arbitrary root certificates. I see no reason why a root cert is necessary.

This is distinct from #1 #15 and #26 because it is not a bug report but, rather, a much needed feature request.

[dexx086]

Totally agree. This plugin is very promising, but I immediately uninstalled it after I saw it wanted to install a ROOT CA... :(
That's just not (should not be) acceptable for any developer (not even average users) to install a "random" root cert, it can imply a high security risk as the issuer (and even the goal) is unclear.

I hope it can be avoided to require installing any cert. I would be happy to try the plugin.

[mike-lischke]

The root certificate is a security measure to authorize access to the webserver provided by the shell process, which is started by the VS Code extension. They use https (and secure web sockets) to communicate to each other to serve the web content shown in the extension. We cannot just ignore possible invaders with man-in-the-middle attacks or similar scenarios, just because we assume every user is a developer who knows all risks. Keep in mind the extension also works with OCI, so there are highly sensitive information going around between the extension and the shell that must be protected.

Having said that, I want to point you to a setting of the extension called "Enforce HTTPS", which you can disable, to use HTTP without a certificate. Does this solve your issue here?

@dexx086 Not installing the certificate is way more insecure. A certificate is always installed for specific servers/services and the OS will manage them. Also you can always go the certificate management tool of your OS to remove the cert, display its details or change the trust settings for it (which may brake the extension, however).

[sosnik]

Hi Mike and thank you for taking the time to reply. Unfortunately, I don't find your reasoning convincing.

The root certificate is a security measure to authorize access to the webserver provided by the shell process, which is started
by the VS Code extension

A root certificate is not needed for this. This can be accomplished with other means, including self-signed non-root certificates (insert into extension trust store rather than system trust store), symmetrical encryption with a common secret, et cetera.

I am also not sure what you mean by "authorize" in this context. A root certificate tells my system "Hey, trust every certificate that is signed with this certificate". This does not do authorization nor authentication, only identification. Is this root cert being used to sign server certificates or client certificates? Because if client certificates, then you don't need them signed by a valid CA. And if it is server certificates, then please see my next point

We cannot just ignore possible invaders with man-in-the-middle attacks or similar scenarios

The webserver and extension will (should?) be limited to communicating on localhost. If someone is MITMing loopback traffic, I have much, much bigger problems than someone sniffing my database credentials — possibly because he can just use a keylogger at that point.

Keep in mind the extension also works with OCI, so there are highly sensitive information going around between the extension and the shell that must be protected

And that's not a problem that can (or needs to be) solved by a local root cert. Communication with OCI should be over a VPN (or other encrypted tunnel) or over HTTPS to a public hostname — in which case, you can provision a normal Let's Encrypt certificate.

Having said that, I want to point you to a setting of the extension called "Enforce HTTPS", which you can disable, to use HTTP without a certificate. Does this solve your issue here?

No, that does not solve my issue for but not limited to the following reasons:

• I still need to accept the certificate to install the extension. I could then remove it, but I do not want to install it in the first place.
• Disabling security features is not, generally, the preferred way of mitigating insecure features.

Some suggestions I can recommend:

• Provision Let's Encrypt certificates - you can do this even for hostnames that are not internet-facing by using DNS-01 challenges.
• Use shared secret or something else local to the webserver and the VS Code extension without needing to contaminate the system trust store.
• Not do anything because it should be happening on loopback
• Give users the option to supply their own certificates and/or security measures.

[mike-lischke]

The root certificate is a security measure to authorize access to the webserver provided by the shell process, which is started
by the VS Code extension

A root certificate is not needed for this. This can be accomplished with other means, including self-signed non-root certificates (insert into extension trust store rather than system trust store), symmetrical encryption with a common secret, et cetera.

Interesting, thanks for sharing this. Tbh. I'm not an expert in that field and guess the solution we have is what worked well at the time of implementing it. If you like, you can open a feature request (or even a pull request) for a better implementation, with details that would help us to get this done.

I am also not sure what you mean by "authorize" in this context. A root certificate tells my system "Hey, trust every certificate that is signed with this certificate". This does not do authorization nor authentication, only identification.

"authorize" in the sense that connections are refused if this certificate does not exist. Web sockets will return with "access denied" errors etc.

The webserver and extension will (should?) be limited to communicating on localhost. If someone is MITMing loopback traffic, I have much, much bigger problems than someone sniffing my database credentials — possibly because he can just use a keylogger at that point.

Keep in mind the extension also works with OCI, so there are highly sensitive information going around between the extension and the shell that must be protected

And that's not a problem that can (or needs to be) solved by a local root cert. Communication with OCI should be over a VPN (or other encrypted tunnel) or over HTTPS to a public hostname — in which case, you can provision a normal Let's Encrypt certificate.

All good points, thanks! I don't know why the approach which is used now was selected, so I cannot comment on that.

Some suggestions I can recommend:

• Provision Let's Encrypt certificates - you can do this even for hostnames that are not internet-facing by using DNS-01 challenges.
• Use shared secret or something else local to the webserver and the VS Code extension without needing to contaminate the system trust store.
• Not do anything because it should be happening on loopback
• Give users the option to supply their own certificates and/or security measures.

Thank you! Notes taken and will be considered once we come to that part of the app again.

Since this is issue is a feature request, I'll leave it open as a reminder.