Add option to not run as system proxy and do not install self-signed cert

[ohaucke]

Adds the following two options:

• --do-not-act-as-system-proxy - Do not set the proxy as system proxy
• --do-not-install-self-signed-cert - Do not install self-signed certificate

The option --do-not-install-self-signed-cert depends on --do-not-act-as-system-proxy and will return the following error message when it's called without it:
Requires option '--do-not-act-as-system-proxy' to be 'true'

That's due to _proxyServer.SetAsSystemHttpsProxy(_explicitEndPoint) which internally calls CertificateManager.EnsureRootCertificate() when ProxyProtocolType.Https is set.

[waldekmastykarz]

Nice start! Let's see how the code changes after we rename options to be "positive".

[waldekmastykarz]

Nice! We're getting closer. A couple more comments.

[waldekmastykarz]

It seems like we changed something that we shouldn't have...

After building the code from this PR, when I run proxy with the default options, I'm getting a cert issue, even though it's already trusted on my machine:

If I build the code from main, all is working as intended.

Let's see what's changed and why with these changes, previously trusted certificates no longer work.

[ohaucke]

That's odd maybe it's loading the wrong cert for the endpoint
https://github.com/microsoft/dev-proxy/pull/530/files#diff-ce6a87a0599e7d66093279273997c48e9c39c5721aa858b9a99b8ab487311668R104

Unfortunately i only have a linux and windows environment to test.

[waldekmastykarz]

That's odd maybe it's loading the wrong cert for the endpoint https://github.com/microsoft/dev-proxy/pull/530/files#diff-ce6a87a0599e7d66093279273997c48e9c39c5721aa858b9a99b8ab487311668R104

Unfortunately i only have a linux and windows environment to test.

No worries, x-plat dev is hard with the different permutations and specifics. I'll dig into it and report back.

[waldekmastykarz]

That's odd maybe it's loading the wrong cert for the endpoint https://github.com/microsoft/dev-proxy/pull/530/files#diff-ce6a87a0599e7d66093279273997c48e9c39c5721aa858b9a99b8ab487311668R104

Unfortunately i only have a linux and windows environment to test.

This line seems indeed to be the culprit. When I remove it, all works as intended. I'll dig deeper as to what's special about it

[waldekmastykarz]

If I look at the code before this PR, then _explicitEndPoint.GenericCertificate stays null after we call _proxyServer.CertificateManager.EnsureRootCertificate();. Where did you find out that we need to call _explicitEndPoint.GenericCertificate = _proxyServer.CertificateManager.LoadRootCertificate(); to load the cert in case we don't use EnsureRootCertificate()?

[waldekmastykarz]

If I remove this line _explicitEndPoint.GenericCertificate = _proxyServer.CertificateManager.LoadRootCertificate(); altogether, proxy seems to be working just fine with the --install-cert false --as-system-proxy false options. Is it needed on Windows?

[ohaucke]

I added that line because otherwise _proxyServer.Start() would call CertificateManager.EnsureRootCertificate().

public void Start(bool changeSystemProxySettings = true)
{
    // ...
    SetThreadPoolMinThread(ThreadPoolWorkerThread);
    if (ProxyEndPoints.OfType<ExplicitProxyEndPoint>().Any((ExplicitProxyEndPoint x) => x.GenericCertificate == null))
    {
        CertificateManager.EnsureRootCertificate();
    }
    // ...
}

Maybe we could change it to the following?

if (_config.InstallCert)
{
    _proxyServer.CertificateManager.EnsureRootCertificate();
}
else
{
    _explicitEndPoint.GenericCertificate = _proxyServer.CertificateManager.LoadRootCertificate();
}

[waldekmastykarz]

Maybe we could change it to the following?

if (_config.InstallCert)
{
    _proxyServer.CertificateManager.EnsureRootCertificate();
}
else
{
    _explicitEndPoint.GenericCertificate = _proxyServer.CertificateManager.LoadRootCertificate();
}

Let's try. Could you please update your code and see if it works properly on Windows? I'll then verify it on mac. I appreciate your help 👏

[ohaucke]

Ok, i've tested it with the changes under windows:

Parameters	Result
--as-system-proxy true --install-cert true	no ssl error and set as system proxy
<no args>	no ssl error and set as system proxy
--as-system-proxy false --install-cert false	as expected "throws ssl error" and you need to ignore the error
--as-system-proxy false --install-cert true	doesn't throw ssl error because root cert is installed
--as-system-proxy true --install-cert false	get's blocked because --as-system-proxy requires --install-cert

I've restarted powershell and removed the installed cert after each test.

PS: Thanks for testing it on mac, as you mentioned x-plat dev is really painful

[waldekmastykarz]

Thanks for the detailed tests! I'll run the same on mac to compare the results and will report back

[waldekmastykarz]

I can confirm that it's working the same way on macOS. Let's do one more update before the final check to merge it 👍