Add fine-grained control over root certificates#1848
Add fine-grained control over root certificates#1848daxpedda wants to merge 1 commit intoseanmonstar:masterfrom
Conversation
daxpedda
force-pushed
the
fine-grained-root-certs
branch
2 times, most recently
from
ccb4304 to
2ca4091
Compare
|
I think would expect it to be something like |
|
That's already available as The original problem is to control more tightly which root certificates to load. Right now, if both |
daxpedda
force-pushed
the
fine-grained-root-certs
branch
from
2ca4091 to
bf69111
Compare
|
Rebased and CI passes. Now that #1850 is merged, it could be argued that if fine-grained control over root certificates is required users can build their own configuration. So if this out-of-scope, let me know. |
## Summary It turns out that on macOS, reading the native certificates can add hundreds of milliseconds to client initialization. This PR makes `--native-tls` a command-line flag, to toggle (at runtime) the choice of the `webpki` roots or the native system roots. You can't accomplish this kind of configuration with the `reqwest` builder API, so instead, I pulled out the heart of that logic from the crate (https://github.com/seanmonstar/reqwest/blob/e3192638518d577759dd89da489175b8f992b12f/src/async_impl/client.rs#L498), and modified it to allow toggling a choice of root. Note that there's an open PR for this in reqwest (seanmonstar/reqwest#1848), along with an issue (seanmonstar/reqwest#1843), which I may ping, but it's been around for a while and I believe reqwest is focused on its next major release. Closes #2346.
|
Sorry for the delay. I've come back to this, and wanted to fix up the merge conflict, and also had a change in thinking as to how to enable/disable. The new PR is at #2232. |
2 participants
As suggested in #1843 (comment), this introduces
ClientBuilder::no_webpki_root_certs()andClientBuilder::no_native_root_certs().Fixes #1843.