PKIX error when running okta start and selecting any option about okta-cli HOT 3 OPEN

Hey @degerlac!

There are a couple of common reasons for seeing this.
1.) You are connecting through some sort of proxy / VPN / network scanner
2.) You have your Okta Org setup with a custom domain and it does NOT have the full certification chain setup

Without any more info I'm going into guess the second, but here is an easy way to test it:

• Go to: https://ssltools.digicert.com/checker/views/checkInstallation.jsp
• Type in your domain for example. id.example.com
• Click on the "Certificate Chain" tab (and check for errors)

If you see errors on this tab, you can correct the problem by following this guide:
https://developer.okta.com/docs/guides/custom-url-domain/enable-the-custom-domain/

The "chain" is optional for some clients (for example most browser connections don't need it), but many languages/frameworks (e.g. Java) require the full chain to be installed.

Either way, let me know if this helps, it's possible we could catch this error and provide better instructions, (but I'm just making an educated guess)

Assuming I'm wrong, let me know your Okta Org / URL and I can take a look. If you don't want to put that info in this issue, you can send it to Okta support, and reference this issue, and tell them to pass the info to @bdemers 😉

from okta-cli.

@bdemers - This is also a problem if the a company uses self-signed certs for things like ZScaler. Is it possible to import a certificate chain into the embedded java truststore the cli is using? Or provide and environment variable like AWS_CA_BUNDLE?

from okta-cli.

@klongmitre, there are no immediate plans to support self-signed certificates with the Okta CLI.

Ideally, we'd like to see folks using certs with chains, but I understand that isn't always as simple as it sounds.
I'll leave this issue open for a bit to see if any other folks are looking for this functionality and we can reconsider it!

I can offer a quick workaround, though, you can grab the Java jar version of the Okta CLI:
https://repo1.maven.org/maven2/com/okta/cli/okta-cli/0.10.0/okta-cli-0.10.0.jar

Run it as:

java -jar /path/to/okta-cli-0.10.0.jar

Then configure your JVM with the appropriate keystore.

from okta-cli.