Repository: vscode
Issue: "unable to get local issuer certificate" attempting to install extensions into dev container by code-server on dev container build
Labels: bug,proxy

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: N/A

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: 1.80.0
- OS Version: Windows 10 21H2

Steps to Reproduce:

1. Create a dev container with one more extensions added in the customisation section
2. Open Dev container when behind a proxy with custom root CA (zscaler)

In this case the extensions are not installed.

I can confirm that extensions are fine to be installed when in the local VS Code environment.

There are also no problems when installing from a WSL remote session.

Interestingly, I can also install the extensions once I am inside the dev container.

The problem seems to be specifically with this `code-server` command:

` /home/vscode/.vscode-server/bin/660393deaaa6d1996740ff4880f1bad43768c814/bin/code-server --log debug --force-disable-user-env --server-data-dir /home/vscode/.vscode-server --use-host-proxy --telemetry-level all --accept-server-license-terms --host 127.0.0.1 --port 0 --connection-token-file /home/vscode/.vscode-server/data/Machine/.connection-token-660393deaaa6d1996740ff4880f1bad43768c814 --extensions-download-dir /home/vscode/.vscode-server/extensionsCache --install-extension jebbs.plantuml --install-extension yzhang.markdown-all-in-one --install-extension DavidAnson.vscode-markdownlint --install-extension shd101wyy.markdown-preview-enhanced --install-extension darkriszty.markdown-table-prettify --install-extension marvhen.reflow-markdown --start-server --disable-websocket-compression`

If I run this manually from the terminal inside the dev container, I can see the following certificate errors:

```
[13:31:16] Installing extensions...
[13:31:16] Extension host agent started.
[13:31:16] No uninstalled extensions found.
[13:31:16] ComputeTargetPlatform: linux-x64
[13:31:16] ComputeTargetPlatform: linux-x64
[13:31:17] unable to get local issuer certificate
[13:31:17] unable to get local issuer certificate
[13:31:17] unable to get local issuer certificate
[13:31:17] unable to get local issuer certificate
[13:31:17] unable to get local issuer certificate
[13:31:17] unable to get local issuer certificate
```

I can only assume this is related to the fact I am using a corporate device that is configured to use Zscaler with custom Root CA installed. (testing no a personal device with same dev container is fine)

If I try the same command but use `code` instead of `code-server`, then the extensions install fine. If I install them from the Extensions pane in the UI, they also install OK. It just seems to be code-server that causes this issue.

I note there is parameter `--use-host-proxy` I have tried removing this, but still have the same issue.

I have tried numerous proxy settings, both on the host and the dev container, either explicitly setting a proxy address, or leaving blank, disabling completely and using combinations of `"http.proxyStrictSSL": false` / `"http.proxyStrictSSL": true"`

I have also tried installing the Zscaler Root CA and intermediate certificates directly in the dev container by copying `.crt` files into `/usr/local/share/ca-certificates` and running `update-ca-certificates`. They are already installed on my Windows laptop and I have tried the `win-ca` extension to either append or replace. Downloading the extensions from the dev container using either curl or wget also works fine.

Nothing I have tried seems to be able to get rid of the unable to get local issuer certificate message when the extensions are attempted to be installed by code-server.

Any thoughts / assistance / guidance greatly appreciated!