Fail to start sample workspaces when using a custom TLS certificate

[l0rd]

Describe the bug

Starting any getting started workspace fails with the following message.

I have deployed Che on minikube. I am using a custom TLS certificate for Che endpoints.

That means that I have:

• created a Kubernets tls secret with the key and certificate
• updated CheCluster setting both spec/k8s/tlsSecretName and /spec/server/cheHostTLSSecret to point to that secret
• add the CA certificate in configmap properly labelled (as described here)

Che version

nightly

Steps to reproduce

Deploy Che on minikube using chectl
Configure Che to use a custom certificate as described here
Start the Java maven sample

Runtime

minikube

minikube version: v1.17.1
commit: 043bdca07e54ab6e4fc0457e3064048f34133d7e

Installation method

$  chectl update next && \
   chectl server:deploy \
       -p minikube

Environment

macOS

[l0rd]

Related to #19168

[l0rd]

Looks like a duplicate of #19120 but that got closed and I can still reproduce the problem using nightly. cc @vitaliy-guliy

[azatsarynnyy]

I'm labeling it as area/plugins since the related functionality comes from the Workspace Plug-in.

[azatsarynnyy]

I've noticed that only *.crt files are taken into account when reading it from the /public-certs folder:
https://github.com/eclipse/che-theia/blob/d4a190ebb3e5b42ad45f4190018b693e26055449/plugins/workspace-plugin/src/ca-cert.ts#L49
I believe it could be fixed by reading all the *.pem files as well, e.g. /public-certs/custom-certs.rootCA.pem.

[mmorhun]

@azatsarynnyy I've run into the same problem, so created PR: eclipse-che/che-theia#1038

[azatsarynnyy]

Thanks @mmorhun!
@l0rd could you check if your issue is reproducible with the following che-theia version:

components:
  - reference: https://raw.githubusercontent.com/chepullreq4/pr-check-files/master/che-theia/pr-1038/simple/che-theia-editor.yaml
    type: cheEditor

It's based on Mykola's PR

[vitaliy-guliy]

Looks like a duplicate of #19120 but that got closed and I can still reproduce the problem using nightly. cc @vitaliy-guliy

We should take into account all the certificates, that are in /public-certs directory.
Thanks to @mmorhun for the fixup.

[l0rd]

Now it's hanging while trying to clone the project: I do not get any error but the project doesn't get cloned.

[vitaliy-guliy]

Trying to reproduce it as it described in the description.

[vitaliy-guliy]

Should be working now