How-To: How install balena-cli in WSL2 if behind Proxy like Zscaler

to lower the entry barrier for others and for me as a reminder, here are my steps to get belena cli operational in Windows Subsystem for Linux 2.
It can probably also be used under Linux (in a VM), but since I have full access to WSL2’s file system (Microsoft, Stack Overflow), I finally decided to go for it because it saves me some problems.
At least that’s what I thought in the beginning.


Before you start, follow Ask Ubuntu and put Root CA in

/usr/local/share/ca-certificates/<subfolder if you like>

and run

sudo update-ca-certificates

If you certificate is .cer you convert it into pem/cer as explained on Stack Overflow:
First you need to figure out if it is either in either in der or pem encoding by echoing its content and see if it is shows a endless string, as described in the answer of eis, depend on the result you do one of the following

openssl x509 -inform der -in certnew.cer -out ymcert.pem
openssl x509 -inform der -in certnew.cer -out ymcert.crt
openssl x509 -in certnew.cer -out ymcert.pem
openssl x509 -in certnew.cer -out ymcert.crt

This will avoid that you get

$ nvm ls-remote 

as described in node.js - NVM on WSL2: cannot install Node, version not found - Stack Overflow


  1. Step npm
    Than start following NPM Installation, balena CLI Advanced Installation Options
    (in short: Install balena-cli on windows 10 wsl (

  2. Step cli
    But before you do the actual install of balena-cli, after you installed npm by doing
    $ npm install balena-cli --global --production --unsafe-perm
    you have to run one of:
    $ export NODE_EXTRA_CA_CERTS="/usr/local/share/ca-certificates/Zscaler/Zscaler Root CA.crt"
    $ export NODE_EXTRA_CA_CERTS="/usr/local/share/ca-certificates/Zscaler/Zscaler Root CA.pem"
    otherwise you run into gyp ERR! stack Error: unable to get local issuer certificate · Issue #979 · nodejs/help (

  3. Step sudo configuration
    as the cli path is not as given as in balena-cli/ at master · balena-io/balena-cli ( It is rather like /home/<user>/.nvm/versions/node/v12.22.9/bin/
    Do learn the right path you can do $ whereis balena .

how to use balena scan ???

so balena cli does run in WSL2 but story has to be continued as balean scan will fail as WSL2 is NAT’d through an Hyper-V Ethernet Adapter, so it won’t reach the clients on the same network as on the host out-of-the-box.

the www is full of discussion, see here my reads

Currently I cannot tell if I can spare the time for another trail&error approach to get it working.


do you wonder what curl -o- means, see bash - Unclear curl command -o- - Stack Overflow

first time configuring the linux Sudoers file, as me?
Do you think, you created but don't know how to uninstall, see here
As I don't have all mind, my resource used