Zowe explorer and Z/OSMF certificate authority intermediate certificate update
Article ID: 400381
Updated On:
Products
Issue/Introduction
After updating the z/OSMF client certificate along with an intermediate certificate, unable to connect to Z/OSMF host from Zowe Explorer.
Zowe explorer log shows the following error:
[2025/05/27 09:28:55.395] [ERROR] [main.extension.js:51] Error: Failed to send an HTTP request.
{
errorDetails: [s [Error]: Failed to send an HTTP request.
at y.populateError (c:\Users\XXXX\.vscode\extensions\zowe.vscode-extension-for-zowe-3.2.0\out\src\vendors.extension.js:419:284)
at ClientRequest.<anonymous> (c:\Users\XXXX\.vscode\extensions\zowe.vscode-extension-for-zowe-3.2.0\out\src\vendors.extension.js:405:21824)
at ClientRequest.emit (node:events:536:35)
at emitErrorEvent (node:_http_client:101:11)
at TLSSocket.socketErrorListener (node:_http_client:504:5)
at TLSSocket.emit (node:events:524:28)
at emitErrorNT (node:internal/streams/destroy:169:8)
at emitErrorCloseNT (node:internal/streams/destroy:128:3)
at process.processTicksAndRejections (node:internal/process/task_queues:82:21)] {
mDetails: {
msg: 'Failed to send an HTTP request.',
causeErrors: [Error: certificate signature failure
at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34)
at TLSSocket.emit (node:events:524:28)
at TLSSocket._finishInit (node:_tls_wrap:1076:8)
at ssl.onhandshakedone (node:_tls_wrap:862:12)] {
code: 'CERT_SIGNATURE_FAILURE'
},
source: 'client',
errorCode: undefined,
protocol: 'https',
port: port,
host: host,
basePath: '',
httpStatus: undefined,
errno: undefined,
syscall: undefined,
payload: undefined,
headers: [ { 'X-CSRF-ZOSMF-HEADER': true } ],
resource: '/zosmf/info',
request: 'GET',
additionalDetails: 'HTTP(S) client encountered an error. Request could not be initiated to host.\n' +
'Review connection details (host, port) and ensure correctness.\n' +
'\n' +
'Protocol: https\n' +
'Host: host\n' +
'Port: port\n' +
'Base Path: \n' +
'Resource: /zosmf/info\n' +
'Request: GET\n' +
'Headers: [{"X-CSRF-ZOSMF-HEADER":true}]\n' +
'Payload: undefined\n' +
'Auth type: basic\n' +
'Allow Unauth Cert: false'
},
mMessage: 'Failed to send an HTTP request.'
},
profile: undefined
}
[2025/05/27 09:28:55.405] [ERROR] [main.extension.js:51] Profile zosmf_XXX is inactive. Please check if your Zowe server is active or if the URL and port in your profile is correct.
Environment
Zowe explore vscode extension
Cause
VSCode comes with a bundled version of NodeJS. NodeJS has its own store of CAs.
To find the version of NodeJS bundled into your version of VSCode:
From VSCode, select this menu entry: Help -> About.
The displayed window contains the version of NodeJS bundled with your version of VSCode.
In the example below, the version of NodeJS is 20.19.0.
You can then find the trusted CAs built into that version of NodeJS.
Using the version number from example above, the following link displays the trusted CAs for NodeJS version 20.19.0.
https://github.com/nodejs/node/blob/v20.19.0/src/node_root_certs.h
You must select your NodeJS version from the drop-down list at the top of the left column of that webpage.
In the right panel, you will then see the set of trusted CA certificates for the version of NodeJS used by your version of VSCode.
If the new Z/OSMF client certificate CA is not among the list of trusted CA certificates for the version of NodeJS used by your VSCode, ZOSMF will not trust that client certificate during the communication (ZOWE explorer connecting to Z/OSMF step).
Resolution
Use the NODE_EXTRA_CA_CERTS environment variable to pass the new CA certificates file to NodeJS:
cat *.cer > node_extra_ca_certs.pembundle
export NODE_EXTRA_CA_CERTS=node_extra_ca_certs.pembundle
Restart vscode after setting up the NODE_EXTRA_CA_CERTS environment variable.
Alternatively, enable the http:System Certificates setting in vscode, this will allow CA certificates loaded from the OS certificate store (vscode/ZOWE explorer only validate the CA in the root CA directory and not the intermediate CA directory), then copy the Intermediate CA that was used to issue the new certificate into the root CA directory of the windows certificate store.
Feedback
