theme get command fails with: x509: certificate signed by unknown authority

[IOIIOOIO]

I tried following the Getting Started documentation but when I run the theme get command it fails with the error message: x509: certificate signed by unknown authority and appears to be referencing the meta.json file

It's worth noting that this is an existing app that I'm taking over from another developer.

My Environment

OS : MacOS High Sierra
Themekit version: v.0.8.0

[tanema]

If you go to the shops domain in your browser like this: https://[shop-name].myshopify.com/meta.json does that succeed? Or do you get a certificate warning?

[Edit]: BTW the meta.json request is just the shop info request. It helps validate that you are indeed requesting a valid shop domain and that the shop is no frozen or shut down.

[IOIIOOIO]

Yes it succeeds

[tanema]

Hmm okay, it may have something to do with your keychain access settings. I don't know too much about it so I will get back to you when I can investigate it.

[tanema]

By any chance are you using a proxy in your config or in general?

[IOIIOOIO]

Sorry I'm not sure what config you're referring to?

This is a shop that is halfway through development, and I've taken over. And I've never worked on a Shopify app before. I want to be able to work on it from my local. I saw that they named the app "Theme Kit" so I figured that's what they were using.

[tanema]

Oh you need to make sure they are using themekit or Slate they handle your projects in different ways. If your theme looks like this: https://github.com/Shopify/skeleton-theme they were probably using Slate.

If however you are using themekit, then there should be a config.yml in the root directory of your project.

[IOIIOOIO]

Ok, I don't see any config file. It also doesn't look like it was done with Slate.

What's interesting to note is I don't seem to have any issues when getting it on my Windows machine...

[tanema]

Okay did you inherit a repo or just the shopify files? If just from shopify, you are getting files from shopify using theme get -t=[theme_id] -s=[store] -p=[password]?

[IOIIOOIO]

Yes there's no repo for this. I've just taken over the store in Shopify.

When I run theme get -t=[theme_id] -s=[store] -p=[password] on my MacBook then I get the certificate error.

When I run the same command on my Windows PC everything works fine.

[tanema]

When I run the same command on my Windows PC everything works fine.

Okay, that indicate that there is something silly with your KeyChain Access. Okay I will have too look into that. Thank you for you help.

[IOIIOOIO]

Ok no problem. Look if it's a big mission for you to help me then don't worry about it. I can work from my Windows machine... it's not ideal but it will do fine.

[tanema]

Okay it seems like this can happen when there are duplicate and untrusted keys in your keychain access.

You can actually see this play out in an issue with Go golang/go#24147

From that issue, I don't have many ways forward with this. I would recommend opening your keychain access and removing any invalid system and root keys and then trying again.

[tanema]

I have also just migrated to Go 1.11 which it seems the go developers have tried to mitigate issues like yours. Please try it out but running theme update --verison=v.0.8.1-prerelease

[sdn90]

I temporarily had this problem which broke all commands that made HTTP requests. I fixed it by opening up a new terminal. I have no idea why that worked.

[tanema]

@IOIIOOIO Did your problem disappear after a restart as has been reported? Because as far as my research has gotten me, it looks like this would most likely be an operating system issue.

[Aeon]

Poking around the repositories, I am pretty sure the issue is golang/go#24652 (resolved in go 1.12) / golang/go#26039 (backport to 1.11, still not released)

As homebrew go version is 1.11, not 1.12, the issue is still present for me...

For now I was able to work around it by doing the following steps:

1. run openssl s_client -connect my-store.myshopify.com:443 and see what certs are used. Check Keychain for presence of the certificates listed. DigiCert SHA2 High Assurance Server CA seems to be missing on my machine.
2. download the DigiCert SHA2 High Assurance Server CA from DigiCert site
3. open Keychain Access and drag the downloaded certificate into login keychain
4. right-click the certificate, expand "Trust" section, and mark it as "Always Trust"

After that, everything seems to work so far...

[tanema]

Hey @Aeon thanks for the deep dive!

Regarding the panic, that should be handled better (and my development path in the trace is just a characteristic of Go) but the reason that was happening to you is that you were trying to update to v.0.8.2-prerelease the problem is that you have an extra period between the v and 0. This caused a panic because that is an invalid semver version. I can add an appropriate error for that.

Regarding the certificate issue, thank you for posting a solution that worked for you, thank you for doing the research, I was aware of those issues while looking into this issue but couldn't say for sure if that was the issue. I don't think I know enough about SSL to understand why you would be missing a certificate on your machine. I will try to talk some people will the experience to figure that out, but identifying that you were actually missing a cert could be a critical bit of information, so thank you so much!

If someone else has this issue as well, please try out a version without CGO by running theme update --version=v1.0.0-issue544 and check to see if it was fixed.

[tanema]

Okay I have updated to a fixed version of Go as well as disabled CGO in themekit. This will be fixed in the v1.0.1 release

[tanema]

This should be fixed in 1.0.1 If you still experience it happening please reopen

[MartijnOost]

I have this same issue

theme get --list -p=[password] -s=groven.myshopify.com
request failed after 5 retries with error: Get https://groven.myshopify.com/meta.json: x509: certificate signed by unknown authority

openssl s_client -showcerts -connect groven.myshopify.com:443
Verify return code: 0 (ok)

theme version
ThemeKit 1.1.4 darwin/amd64

MacOS Big Sur
Version 11.1

[FedericoCapaldo]

@MartijnOost any update on how you solved this issue?

[MartijnOost]

I didnt... Moved on to bigger and better problems. :-(

[gao0923]

@MartijnOost, did you fix the above issue?

[MartijnOost]

Nope