# how to import proxy server certificates into CLI and OS?

**URL:** <https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818>\
**Category:** balenaOS\
**Tags:** support\
**Created:** [January 6, 2022, 9:27am UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818 "2022-01-06T09:27:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 6, 2022, 9:27am UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/1 "2022-01-06T09:27:03Z")

</div>

Hello,  
my balenaOS image fails to connect to the cloud, same for CLI `balena login`.

`balena login -debug` gives:

```auto
FetchError: request to https://api.balena-cloud.com/user/v1/whoami failed, reason: unable to get local issuer certificate
    at ClientRequest.<anonymous> (C:\MEINS\TOOLS\balena-cli\client\node_modules\node-fetch\lib\index.js:1461:11)
    at ClientRequest.emit (events.js:326:22)
    at ClientRequest.EventEmitter.emit (domain.js:483:12)
    at TLSSocket.socketErrorListener (_http_client.js:427:9)
    at TLSSocket.emit (events.js:314:20)
    at TLSSocket.EventEmitter.emit (domain.js:483:12)
    at emitErrorNT (internal/streams/destroy.js:92:8)
    at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)
    at processTicksAndRejections (internal/process/task_queues.js:84:21)

```

I assume that is due to ZScaler proxy. I have its certificates but how get them into the OS and CLI?

* * *

by the way, can I work 100% locally on production using [SSH](https://www.balena.io/docs/learn/manage/ssh-access/) as [the manual](https://www.balena.io/docs/learn/develop/local-mode/) says I need a dev image?

---

<div class="post-metadata">

**Author:** ![Hades32](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/hades32/32/6430_2.png) [@Hades32](https://forums.balena.io/u/Hades32)\
**Post date:** [January 6, 2022, 9:51am UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/2 "2022-01-06T09:51:37Z")

</div>

Hey,

you shouldn’t need to install the certificate twice. It should be sufficient to install them into the OS, e.g. like this: [How to install Windows 10/11 root certificates [EASY STEPS]](https://windowsreport.com/install-windows-10-root-certificates/)

I’m not sure what you mean with “work 100% locally”. You can connect to a production image via ssh via two ways:

- as root (`ssh -p 22222 root@your-device-ip`) IF you have set a custom SSH key as part of provisioning
- as your balena user (e.g. `ssh -p 22222 martin20@your-device-ip`)

What you cannot do with a production image, is push code from your machine (i.e. `balena push device-ip-address`)

Hope that helps.

Cheers,  
Martin

---

<div class="post-metadata">

**Author:** ![Hades32](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/hades32/32/6430_2.png) [@Hades32](https://forums.balena.io/u/Hades32)\
**Post date:** [January 6, 2022, 9:54am UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/3 "2022-01-06T09:54:35Z")

</div>

If you meant your device and balenaOS, then this is where you need to place your certificate: [Configuration - Balena Documentation](https://www.balena.io/docs/reference/OS/configuration/#balenarootca)

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 6, 2022, 12:56pm UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/5 "2022-01-06T12:56:34Z")

</div>

> [@Hades32](#):
>
> I’m not sure what you mean with “work 100% locally”. You can connect to a production image via ssh via two ways:

meant from my local machine where the VM runs into BalenaOS on the VM.  
I think that is answered by your reply

> [@Hades32](#):
>
> if you meant your device and balenaOS,

so that would mean

```auto
{
  "hostname": "my-custom-hostname",
  "persistentLogging": true,
   "balenaRootCA": "-----BEGIN CERTIFICATE-----MIIE0zCCA7......hFjE0xd-----END CERTIFICATE-----"
   "os": {
   ....
   }   
}

```

without line breaks?

how do I achieve the same for [balena CLI Documentation - Balena Documentation](https://www.balena.io/docs/reference/balena-cli/)?

---

<div class="post-metadata">

**Author:** ![mtoman](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/mtoman/32/3599_2.png) [@mtoman](https://forums.balena.io/u/mtoman)\
**Post date:** [January 6, 2022, 1:26pm UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/6 "2022-01-06T13:26:06Z")

</div>

Hi,

I understand you have the certificate in PEM format (`-----BEGIN CERTIFICATE-----\nMIIE0zCCA7......hFjE0xd\n-----END CERTIFICATE-----`), stored in a file say `cert.pem`.

- For `config.json` you need to take the contents of the PEM file and base64-encode them using e.g. `base64 -w0 < cert.pem` then use the output for `balenaRootCA` in the `config.json` file.
- For balena CLI, you need to populate the `NODE_EXTRA_CA_CERTS` variable, you can either prepend each command (e.g. `NODE_EXTRA_CA_CERTS=cert.pem balena login`) or do `export NODE_EXTRA_CA_CERTS=cert.pem` once at the very beginning and then use balena CLI as usual.

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 6, 2022, 1:56pm UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/8 "2022-01-06T13:56:08Z")

</div>

> [@mtoman](#):
>
> For balena CLI, you need to populate the `NODE_EXTRA_CA_CERTS` variable

as I’m on Windows, so that means:

> Windows: `set NODE_EXTRA_CA_CERTS=C:\path\to\your\ca.pem`  
> Use the UI to set a environment variable to make it more permanent.  
> **Note** `ca.pem` should be just your CA.

source: [Error: self signed certificate in certificate chain · Issue #87 · jasongin/nvs (github.com)](https://github.com/jasongin/nvs/issues/87)

but make sure don’t to use “…”, so  
do **n’t** : ` \balena-cli\bin>set NODE_EXTRA_CA_CERTS="C:\Users\...\Zscaler Root CA.cer"`  
do: ` \balena-cli\bin>set NODE_EXTRA_CA_CERTS=C:\Users\...\Zscaler Root CA.cer`

* * *

* * *

> [@mtoman](#):
>
> For `config.json` you need to take the contents of the PEM file and base64-encode them using e.g. `base64 -w0 < cert.pem` then use the output for `balenaRootCA` in the `config.json` file.

will check later, reading [Zowe CLI: Providing NODE\_EXTRA\_CA\_CERTS | by Dan Kelosky | Zowe | Medium](https://medium.com/zowe/zowe-cli-providing-node-extra-ca-certs-117727d936e5) as well.

How to deal, when multiple certificates are supposed to be used

```auto
{
   ...
   "balenaRootCA": "<base64encodedPEMfile_1>","<base64encodedPEMfile_2>" ,... 
}

```

?

---

<div class="post-metadata">

**Author:** ![mtoman](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/mtoman/32/3599_2.png) [@mtoman](https://forums.balena.io/u/mtoman)\
**Post date:** [January 6, 2022, 2:55pm UTC](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818/9 "2022-01-06T14:55:02Z")

</div>

You can merge the certificates into a single PEM file, it would then look something like

```auto
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
yyy
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
zzz
-----END CERTIFICATE-----

```

Using such file will work with both `config.json` and CLI.