Error: VS Code Extension "Unable to Verify the First Certificate"

Summary

When connecting from VS Code Desktop to a Coder workspace, users may encounter the following error:

Failed to check user authentication: Secure connection to your Coder deployment failed: unable to verify the first certificate

This error typically indicates a certificate chain issue related to external Certificate Authorities (such as DigiCert) or internal/private CAs. It is generally a configuration discrepancy between the local environment and the server SSL certificate, rather than a bug in the Coder platform itself.

Root Cause

VS Code runs on Electron, which enforces stricter certificate validation requirements than other common tools like curl, golang clients, or web browsers.

• Incomplete Certificate Chain: The TLS certificate served by the Coder deployment (or its ingress/proxy) may only contain the "leaf" certificate, missing the required intermediate certificates.

• Electron vs. Browsers: Tools like Chrome or the Coder CLI may accept a leaf certificate if the client trusts it. However, Node.js and Electron require the full certificate chain, linking the leaf back to a trusted Root CA.

Method 1: Template Admin Fix (Terraform)

Best for: Fixing the issue for all users of a specific template. If the Coder Agent inside the workspace cannot talk to the Coder server due to certificate issues, you must inject the CA certificate and set the NODE_EXTRA_CA_CERTS environment variable in the Terraform template.

Health checks can also have problems connecting - but should work with these guidance.

If these instructions do not work, please send Coder a Support Ticket with your description of the problem, logs, k8s logs/description and layout of the .tls/.pem files.

1. Upload the CA Certificate to the Workspace Ensure the CA certificate file (e.g., ca-cert.pem) is present in the workspace image or injected via Terraform.

2. Set the Environment Variable in coder_agent Modify your main.tf file to set the NODE_EXTRA_CA_CERTS variable within the coder_agent resource. This can also be done with base64 encoded entries, Volumes and Secrets:

resource "coder_agent" "main" {
  arch           = data.coder_provisioner.me.arch
  os             = "linux"
  
  # Point to the location where the CA certificate exists inside the workspace
  env = {
    NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/your-internal-ca.pem"
  }
}

3. (Optional) Inject Certificate via Terraform If the certificate is not baked into the Docker image/Kubernetes, you can use coder_file to place it:

resource "coder_file" "ca_cert" {
  agent_id = coder_agent.main.id
  content  = file("path/to/local/ca-cert.pem") # Or use a variable
  path     = "/home/coder/ca-cert.pem"
}

resource "coder_agent" "main" {
  # ... other config ...
  env = {
    NODE_EXTRA_CA_CERTS = "/home/coder/ca-cert.pem"
  }
}

Administrator Fix (Coder/Helm/K8s-Side)

Recommended: If multiple users are experiencing this issue, the Coder Administrator should fix the certificate chain at the source (the Coder deployment or Ingress).

Option A: Bundle the Full Certificate Chain

For external CAs (like DigiCert), you must concatenate the leaf certificate with all intermediate certificates into a single file.

Order of Concatenation:

1. Leaf Certificate (Your Domain)

2. Intermediate Certificate(s)

3. Root CA (Optional)

Command Example:

cat leaf-certificate.crt intermediate-ca.crt > fullchain.crt

• Note: You can download the intermediate certificate directly from your Certificate Authority provider.

Option B: Update Kubernetes Ingress Secret

If your Coder deployment uses a Kubernetes ingress controller for TLS termination, ensure the secret contains the full chain.

apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  name: coder-tls
data:
  # Value must be base64 encoded version of the full chain (Leaf + Intermediates)
  tls.crt: 
  tls.key: 

Verification Steps

You can verify the certificate chain using openssl.

1. Check for Multiple Certificates

Run the following command and look for multiple certificates in the output (Chain 0, Chain 1, etc.). If you only see one, the chain is incomplete.

openssl s_client -connect your-coder-deployment.example.com:443 -showcerts

2. Verify Validity

This should return Verify return code: 0 (ok).

openssl s_client -connect your-coder-deployment.example.com:443 \
  -servername your-coder-deployment.example.com \
  -verify 5

3. Check Key Usage Extensions

For Electron compatibility, a self-signed certificate must have specific constraints:

• Key Usage: digitalSignature, keyEncipherment

• Extended Key Usage: serverAuth

• Basic Constraints: CA:FALSE

openssl x509 -in your-cert.pem -noout -text | grep -A2 "X509v3 Key Usage"

Common Scenarios

Related Resources & Versions

• Coder Server: v2.27.3 and later

• VS Code: 1.78.2 and later

• Extension: Latest version recommended

• GitHub Issue #105: Certificate issues

• Electron Issue #38527: Certificate validation