{"id":1950,"date":"2021-08-11T21:38:31","date_gmt":"2021-08-11T16:08:31","guid":{"rendered":"https:\/\/judepereira.com\/blog\/?p=1950"},"modified":"2021-11-18T19:03:43","modified_gmt":"2021-11-18T13:33:43","slug":"getting-the-aws-cli-to-accept-cloudflare-warps-root-certificate","status":"publish","type":"post","link":"https:\/\/judepereira.com\/blog\/getting-the-aws-cli-to-accept-cloudflare-warps-root-certificate\/","title":{"rendered":"Getting the AWS CLI to accept Cloudflare WARP’s root certificate"},"content":{"rendered":"\n

When we moved to Cloudflare WARP at CleverTap, everything worked as expected, except for the AWS CLI:<\/p>\n\n\n\n

SSL validation failed for https:\/\/ec2.eu-west-1.amazonaws.com\/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)<\/code><\/pre>\n\n\n\n
The problem with Cloudflare WARP is that it’s the equivalent of Charle’s Proxy – presenting its own certificate for everything. While this works for almost everything, it doesn’t work for tools that use a well known and publicly trusted CA bundle. <\/p>\n\n\n\n
Moreover, AWS’ CLI v2 is built with Python, which apparently doesn’t even have access to macOS’ Keychain. So, although that Cloudflare WARP certificate is installed in Keychain, tools from JetBrains and AWS’ very own CLI will refuse to work. <\/p>\n\n\n\n
The solution? Download a .crt from Cloudflare’s documentation<\/a>, convert it to a .pem (using Keychain), and then add it to your CA bundle (in my case, the default one installed by Homebrew).<\/p>\n\n\n\n
Preparing the certificate<\/h2>\n\n\n\n
Download the certificate from here<\/a>. Next, open it up in Keychain:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Right click on that entry, to see the Export option:<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Export it as a PEM:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Hit Save.<\/p>\n\n\n\n
Installing the certificate<\/h2>\n\n\n\n
And now to the tricky part. The CA bundle that AWS uses for its CLI is a mystery. However, it does allow one to override that, by using an environment variable. So, we want that CLI to trust the usual set of root certificates, along with Cloudflare’s. OpenSSL installs a decent set of trusted root certificates, which we can append to:<\/p>\n\n\n\n
$ cat Cloudflare.pem >> \/Users\/jude\/bin\/Homebrew\/etc\/openssl\/cert.pem<\/code><\/pre>\n\n\n\n
All that’s remaining is to tell the AWS CLI to use it:<\/p>\n\n\n\n
$ export AWS_CA_BUNDLE=\/Users\/jude\/bin\/Homebrew\/etc\/openssl\/cert.pem<\/code><\/pre>\n\n\n\n
And voila! It starts working magically! <\/p>\n","protected":false},"excerpt":{"rendered":"
Download, convert, and install the Cloudflare WARP root certificate into your local set of trusted root CAs, and then tell the AWS CLI to use it.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[12],"tags":[671,670,677,672,673,679,678,675,676,674],"class_list":["post-1950","post","type-post","status-publish","format-standard","hentry","category-misc","tag-aws","tag-aws-cli","tag-certificates","tag-cli","tag-cloudflare","tag-homebrew","tag-openssl","tag-ssl","tag-tls","tag-warp"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t