-
|
Does the feature I think the best solution would be that this option does both: use a pre-configured root store, and read the OS's certificates. (mostly for self-signed certs) Is this possible? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
It would replace the webpki-roots.
So it would use whatever method schannel, secutity-framework or openssl respectively do to get their root certs. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the answer. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, native-tls will always use the system root store by default (though you can configure custom roots with it if you want). It sounds like what you want may be to use rustls, and for building the root store use both rustls-native-certs (which tries to read the system root store, with some caveats) and webpki-roots (which bundles a set of roots at build time). You can load both sets of roots into a single trust store. There are some tradeoffs to each approach, which are probably too long to get into here, but if what you want is to make sure that you trust a basic set of roots no matter what system you are deployed on, and also trust any locally trusted roots, that would accomplish what you want. |
Beta Was this translation helpful? Give feedback.
-
|
Also thanks for your answer.
To be honest, this should be the default without having to code anything yourself. Here is my reasoning: Most OSes keep an updated root store, which makes it better to use the OS trust store than the one bundled during compile time. Not using |
Beta Was this translation helpful? Give feedback.
It would replace the webpki-roots.
So it would use whatever method schannel, secutity-framework or openssl respectively do to get their root certs.