Insomnia: [Feature] Ability to provide custom CA Certificate

[gschier]

libcurl provides a way to specify a CA bundle used for requests (CURLOPT_CAINFO). Currently, this is being used to provide a base CA bundle for Windows and Linux, but a user-supplied bundle could be concatenated to this fairly easily.

To-Do

• Add setting to workspace settings to import a custom CA bundle (PEM format)
• Add logic to concatenate user-supplied bundle to base bundle (if Windows or Linux). On Mac, simply provide user-supplied bundle

Unknowns

Since Curl retrieve the base CA bundle from the OS on Mac, it's unclear whether or not setting CURLOPT_CAINFO will override this bundle entirely or add to it. This needs to be tested.

[aaron-trout]

Providing a CA on a per environment or per request basis might provide better flexibility than per workspace. For example talking to Kubernetes API and providing the cert to validate with.

[coderjoe]

This is something I'd be very interested in having. I'd love to give a PR a try.

[gschier]

@aaron-trout I agree that it's more flexible but I don't think the use case for a global CA cert is much more common. If we see enough desire to add per-request CA certs later, we can come up with a mechanism to do so.

@coderjoe are you still wanting to give this a try? It might end up being quite a bit of work but I'm happy to point you in the right direction. I'm picturing a new tab in the workspace setting (beside Client Certificates) to upload additional CA certificates.

[coderjoe]

@gschier absolutely still interested. I'll likely need help with testing on Mac OSX as I only have Linux and Windows machines.

[gschier]

Sure, I could definitely help test that out :smile:

[coderjoe]

Sorry for the delay. I very much appreciate the guidance/suggestions. If I run into any snags or questions I'll be sure to ask here.

Edit: Right now I'm using the existing certificate model and UI as a template to allow people to add CA Bundles. It's making it pretty easy to jump right in.

[gschier]

Nice! 👍 😄

[macbookandrew]

I’d love to see this feature too and can help test it out.

As a workaround, you can also install curl using homebrew on macOS and it appears to use the macOS keychain CA certificate store instead of whatever the native curl uses, so if you have a custom cert marked as trusted in your Keychain.app, Insomnia will connect without a certificate error.

[coderjoe]

As is probably obvious by lack of commits, I ran into some snags and haven't had time to come back to this issue. If anybody else wants to give it a whack please feel free. I have no significant progress to share at this time.

I am still interested in the feature, it just isn't really a critical feature for me anymore. Maybe I'll have time later this year to revisit it.

[jsfrerot]

Just had the issue with our internal root CA. Would be nice to make this work.

[gyvasileciorna]

Yes have this issue as well. Is there any progress on this? Importing CA bundles is something which is useful and think should be included in the app.

[lsuttle]

Another +1, I cannot use this without this functionality.

[develohpanda]

Hi @lsuttle, there is a PR currently open but is blocked on testing and validating the new functionality (https://github.com/Kong/insomnia/pull/2020#issuecomment-630466618). Is this something you may be able to help with? If so, I can prepare a bundle to install on your OS.

[ryanprior]

I could help with validation. I'm on elementary OS 5.1.5 (like Ubuntu Precise) and I'm using mkcert as my local CA for API testing. If you can provide a bundle I'd be happy to try it with that configuration.

[lsuttle]

Sure I can give it a try, I have most recent Windows 10 install.