Tunneling socket - self signed certificate - OWASP ZAP Proxy

[TheRealArlie]

1. Newman Version (can be found via newman -v): 5.1.0

2. OS details (type, version, and architecture): linux

3. Are you using Newman as a library, or via the CLI? 'CLI`

4. Did you encounter this recently, or has this bug always been there: I just started to use it in this way

5. Expected behavior: I would like to run newman through OWASP ZAP Proxy in order to do security analysis on an API we have. ZAP is creating self signed certificates for the sites proxied through it. Using the --insecure flag newman should ignore that the ZAP SSL-Certificate is self signed. But what happens is that newman states: GET https://juice-shop.herokuapp.com/rest/user/whoami [errored] tunneling socket could not be established, cause=self signed certificate in certificate chain

Doing the same in Postman while deactivating SSL checks everything works fine.

5. Command / script used to run Newman: HTTP_PROXY=http://127.0.0.1:8080/ HTTPS_PROXY=https://127.0.0.1:8080/ newman run juice_shop.json --insecure

6. Sample collection, and auxiliary files (minus the sensitive details):

{
	"info": {
		"_postman_id": "ec21d985-19c7-419c-b0c9-c87274ce3031",
		"name": "ZAP Proxy Test",
		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
	},
	"item": [
		{
			"name": "whoami",
			"request": {
				"method": "GET",
				"header": [],
				"url": {
					"raw": "https://juice-shop.herokuapp.com/rest/user/whoami",
					"protocol": "https",
					"host": [
						"juice-shop",
						"herokuapp",
						"com"
					],
					"path": [
						"rest",
						"user",
						"whoami"
					]
				}
			},
			"response": []
		}
	],
	"protocolProfileBehavior": {}
}

Steps to reproduce the problem:

1. Start OWASP ZAP Proxy (listening on 127.0.0.1:8080 for http and https)
2. Start newman using ZAP as Proxy: HTTP_PROXY=http://127.0.0.1:8080/ HTTPS_PROXY=https://127.0.0.1:8080/ newman run juice_shop.json --insecure

[DannyDainton]

Hey @TheRealArlie,

Is this still something that you're having issues with or did you resolve the problem?

[TheRealArlie]

Hi @DannyDainton , we still have this issue. We were not able to solve it.

Cheers, Robin

[DannyDainton]

Thanks for the update @TheRealArlie 👍

[sonawanesarvesh]

Hello i am also getting same error, any further updates?

[sonawanesarvesh]

Hello i have resolved this by other way - We used socks-proxy (https://www.npmjs.com/package/newman#using-socks-proxy)

observed - mostly the tunneling issue occurs because of wrong proxy configurations

[untra]

the error tunneling socket could not be established, cause=self signed certificate in certificate chain is thrown by nodejs to intentionally prevent insecure tls connections, which is likely happening when proxying an https endpoint with ZAP's self-signed certificate.

https://nodejs.org/api/cli.html#node_tls_reject_unauthorizedvalue

I don't see any mention of setting NODE_TLS_REJECT_UNAUTHORIZED=0, which likely plays a role here.

[TheRealArlie]

It's been a long time, but our brilliant student finally had time to tackle the problem.

Here our fix:

1. Start OWASP ZAP Proxy (listening on 127.0.0.1:8080 for http and https)
2. Save the ZAP CA to a file owasp_zap_root_ca.cer
3. Start newman using ZAP as Proxy: HTTP_PROXY=http://127.0.0.1:8080/ HTTPS_PROXY=http://127.0.0.1:8080/ newman run --ssl-extra-ca-certs owasp_zap_root_ca.cer juice_shop.json

Our issue was a combination of two problems:

1. we were not using --ssl-extra-ca-certs owasp_zap_root_ca.cer
2. we used HTTPS_PROXY=http >>>S<<< ://127.0.0.1:8080/ instead of HTTPS_PROXY=http://127.0.0.1:8080/

We would consider this issue as fixed by using this solution.

Thanks for your help!