ABAP Remote Filesystem in VS Code Behind Zscaler - Certificate Errors

[MusOA]

Hello everyone,

I'm currently working with an ABAP system connected via "ABAP remote filesystem" within VS Code. I'm able to successfully connect to the system, modify ABAP code, and see these changes reflected in the backend.

However, despite this basic functionality, I'm consistently encountering a series of errors in my VS Code output, primarily related to SSL/certificate issues. These errors prevent crucial functionalities like syntax checks, finding definitions, and document formatting from working correctly.

Key Details of my Setup:

• ABAP System: Connected via "ABAP remote filesystem".
• Development Environment: VS Code version 1.104.3 (user setup) on Windows 11.
• Network Environment: We operate behind a corporate proxy, Zscaler. I've confirmed that the Zscaler certificate is installed on my laptop and is currently valid.

Specific Errors Encountered:

The most critical error message I'm seeing repeatedly is "unable to get local issuer certificate". This appears in various contexts:

Exception in syntax check: unable to get local issuer certificate
Exception in find definition: unable to get local issuer certificate
Request textDocument/formatting failed with message: unable to get local issuer certificate
Additionally, I'm seeing multiple "Error in stat of adt://1-abap_sandbox_system/..." for various files and directories (e.g., node_modules, pom.xml, AndroidManifest.xml, build.gradle, pyproject.toml, setup.cfg, tox.ini, pylintrc). While these might be related to the core certificate issue or perhaps missing project files irrelevant to ABAP, the "unable to get local issuer certificate" seems to be the root cause of functional issues.

        Error in stat of adt://1-abap_sandbox_system/node_modules
        adt://1-abap_sandbox_system/node_modules
        Error in stat of adt://1-abap_sandbox_system/pom.xml
        adt://1-abap_sandbox_system/pom.xml
        Error in stat of adt://1-abap_sandbox_system/pom.xml
        adt://1-abap_sandbox_system/pom.xml
        Error in stat of adt://1-abap_sandbox_system/app/src/main/AndroidManifest.xml
        adt://1-abap_sandbox_system/app/src/main/AndroidManifest.xml
        Error in stat of adt://1-abap_sandbox_system/build.gradle
        adt://1-abap_sandbox_system/build.gradle
        Error in stat of adt://1-abap_sandbox_system/pyproject.toml
        adt://1-abap_sandbox_system/pyproject.toml
        Error in stat of adt://1-abap_sandbox_system/setup.cfg
        adt://1-abap_sandbox_system/setup.cfg
        Error in stat of adt://1-abap_sandbox_system/tox.ini
        adt://1-abap_sandbox_system/tox.ini
        Error in stat of adt://1-abap_sandbox_system/pylintrc
        adt://1-abap_sandbox_system/pylintrc
        Error in stat of adt://1-abap_sandbox_system/node_modules
        adt://1-abap_sandbox_system/node_modules
        Exception in syntax check: unable to get local issuer certificate 
        Exception in find definition: unable to get local issuer certificate 
        Exception in find definition: unable to get local issuer certificate 
        [Error - 3:54:35 PM] Request textDocument/formatting failed.
          Message: Request textDocument/formatting failed with message: unable to get local issuer certificate
          Code: -32603 

Troubleshooting Steps Taken:

I've already attempted some common solutions found online, including playing with http.proxyStrictSSL and NODE_EXTRA_CA_CERTS settings, but without success.

Request for Help:

Could anyone provide guidance or insights into how to resolve these persistent "unable to get local issuer certificate" errors when connecting to an ABAP system via ABAP remote filesystem in VS Code, especially when operating behind a Zscaler corporate proxy? Any suggestions for further troubleshooting steps or configuration adjustments would be greatly appreciated.

Thank you in advance for your assistance!

[marcellourbani]

Doesn't allowSelfSigned work?
I believe vscode uses its own internal proxy by default, so NODE_EXTRA_CA_CERTS might have to be set before you even start vscode, assuming it's supported

[MusOA]

Thank you for your prompt response, @marcellourbani, and for all your hard work on this.

If you're referring to proxyStrictSSL, I've already attempted to deactivate it, but the errors mentioned above persist

Here is my setting.json :

{
"abapfs.remote": {

"1-ABAP_sandbox_system": {
  "url": "https://url:port/",
  "client": "001",
  "user": "user_id",
  "username": "user_id",
  "language": "EN",
  "allowselfsigned": true
}

},
"http.proxyStrictSSL": false
}

[marcellourbani]

did you try customCA ?

[MusOA]

Could you please tell me how can I try customCA ?
Thanks again @marcellourbani for your help

[marcellourbani]

just set it to the path of your CA certificate

[MusOA]

I've tried it, with the syntax below (+reload window/and restart VS code), same result :-( :

{
"abapfs.remote": {

"1-ABAP_sandbox_system": {
"url": "https://url:port/",
"client": "001",
"user": "user_id",
"username": "user_id",
"language": "EN",
"allowselfsigned": true
}
},

"http.proxyStrictSSL": false,
"customCA" : "C://Users//user.name//Zscaler Root CA.crt"
}

Thanks again for your help