<p dir="auto">Hi,</p>
<p dir="auto">Just installed deno and try to run welcome.ts file which is mentioned in docs, i am facing this issue. Details are below.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="D:\deno&gt;deno run https://deno.land/welcome.ts
Downloading https://deno.land/welcome.ts
WARN RS - Sending fatal alert BadCertificate
an error occurred trying to connect: invalid certificate: UnknownIssuer
an error occurred trying to connect: invalid certificate: UnknownIssuer"><pre class="notranslate"><code class="notranslate">D:\deno&gt;deno run https://deno.land/welcome.ts
Downloading https://deno.land/welcome.ts
WARN RS - Sending fatal alert BadCertificate
an error occurred trying to connect: invalid certificate: UnknownIssuer
an error occurred trying to connect: invalid certificate: UnknownIssuer
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="D:\deno&gt;deno version
deno: 0.4.0
v8: 7.6.53
typescript: 3.4.1"><pre class="notranslate"><code class="notranslate">D:\deno&gt;deno version
deno: 0.4.0
v8: 7.6.53
typescript: 3.4.1
</code></pre></div>
<p dir="auto">Anybody faced this issue.</p>
<p dir="auto">There should be a way to allow insecure https requests, using <code class="notranslate">window.fetch()</code> for example.<br>
It should disable certificate validation for all requests made from the program.</p>
<p dir="auto">As of implementation, there are two optoins that come to my mind: environment variable and flag. Below are some examples of how it's done in other web-related software, so we can come up with intuitive name and approach.</p>
<p dir="auto">Examples:</p>
<ul dir="auto">
<li>In NodeJS, <a href="https://github.com/nodejs/node/blob/2cb8f247512d611d3dfe81c2441e8028bfb0e8f0/doc/api/cli.md#node_tls_reject_unauthorizedvalue">there is</a> a <code class="notranslate">NODE_TLS_REJECT_UNAUTHORIZED</code> environment variable that can be set to <code class="notranslate">0</code> to disable TLS certificate validation. It takes name from <a href="https://nodejs.org/docs/latest/api/tls.html#tls_tls_connect_options_callback" rel="nofollow">tls.connect options.rejectUnauthorized</a></li>
<li>In curl, there's a <code class="notranslate">-k</code> or <code class="notranslate">--insecure</code> flag, which allows insecure server connections when using SSL</li>
<li>In Chrome, there's a <code class="notranslate">--unsafely-treat-insecure-origin-as-secure="https://example.com"</code> for the same purposes</li>
<li>For WebDrivers, there's <a href="https://developer.mozilla.org/en-US/docs/Web/WebDriver/Capabilities/acceptInsecureCerts" rel="nofollow">acceptInsecureCerts</a> capability. It can allow self-signed or otherwise invalid certificates to be implicitly trusted by the browser.</li>
</ul>
<p dir="auto">That said, I'd like to see <code class="notranslate">--accept-insecure-certs</code> flag option, because deno already uses flags for a lot of things, including permissions.</p>
<hr>
<p dir="auto">My use-case: I'm using a corporate Windows laptop with network monitoring. AFAIK, all https requests are also monitored, so there's a custom SSL-certificate installed system-wide. So, most of the software, that uses system CA storage, works just fine. But some uses custom or bundled CA, and it seems like it's a case with deno. Anyway, it downloads deps just fine, but fails to perfprm any https request.</p>
<p dir="auto">Issue created as a follow up to gitter conversation: <a href="https://gitter.im/denolife/Lobby?at=5c1965a79f431114186027c0" rel="nofollow">December 18, 2018 1:24 PM</a></p>