Coder workspaces connection fails: PKIX path building failed with an internal certificate authority

Problem

The Coder workspaces dialog fails to connect to a self-hosted Coder deployment. After a click on Connect, the dialog shows the following error:

Connection to https://coder.example.com/ failed: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. See the documentation for TLS certificates for information on how to make your system trust certificates coming from your deployment.

The error occurs when the Coder deployment uses a TLS certificate issued by a company (internal) certificate authority, or a self-signed certificate. The dialog belongs to the Coder plugin (com.coder.gateway), which runs in the Remote Development of IntelliJ-based IDEs and in JetBrains Gateway.

Cause

The Coder plugin is a third-party plugin developed by Coder. The plugin trusts only two sources of certificates: the Java runtime bundled with the IDE, and the file in the plugin's CA path setting. The plugin does not read the certificate store of the operating system or the server certificates trusted in the IDE. A company certificate authority that the operating system trusts is therefore not trusted by the plugin.

Resolution

Add the root certificate of the company certificate authority to the Coder plugin. The Coder documentation describes the setup in Configure the Gateway plugin to use internal certificates. The documentation for TLS certificates link in the error message opens a general page without this section.

For other questions about the Coder plugin, contact Coder through the Coder plugin issue tracker on GitHub. The request to make the plugin trust the same certificates as the IDE is coder/jetbrains-coder#359.