Skip to content

Conversation

@flokli
Copy link
Contributor

@flokli flokli commented Nov 3, 2025

quiche doesn't automatically configure a set of CA certificates to use when enabling verification (as it doesn't enable verification by default either), so it was never possible to connect to an endpoint with a valid certificate, as the set of trusted root was empty.

Fix this, by calling
qconfig.load_verify_locations_from_{directory_file} with the results of a openssl_probe::probe() call - the same that rustls-native-certs uses in the Linux case.
It uses SSL_CERT_FILE / SSL_CERT_DIR env vars, with sane defaults.

I opted against using rustls-native-certs. It also supports reading from the system certificate store / keychain on Windows and MacOS, but as quiche only allows specifying a directory/file where it reads these on its own, and not from memory, and writing this kind of stuff to a temporary file before reading it back in sounds like a nightmare.

With this, I'm able to point psq-client to my server with a LE certificate, without having to specify --ignore-cert.

quiche doesn't automatically configure a set of CA certificates to use
when enabling verification (as it doesn't enable verification by default
either), so it was never possible to connect to an endpoint with a valid
certificate, as the set of trusted root was empty.

Fix this, by calling
`qconfig.load_verify_locations_from_{directory_file}` with the results
of a `openssl_probe::probe()` call - the same that rustls-native-certs
uses in the Linux case.
It uses SSL_CERT_FILE / SSL_CERT_DIR env vars, with sane defaults.

I opted against using rustls-native-certs. It also supports reading from
the system certificate store / keychain on Windows and MacOS, but as quiche only
allows specifying a directory/file where it reads these on its own, and
not from memory, and writing this kind of stuff to a temporary file
before reading it back in sounds like a nightmare.

With this, I'm able to point psq-client to my server with a LE
certificate, without having to specify `--ignore-cert`.
@PasiSa PasiSa merged commit c1e8d3e into PasiSa:main Nov 5, 2025
1 check passed
@PasiSa
Copy link
Owner

PasiSa commented Nov 5, 2025

Thanks, applied!

@flokli flokli deleted the ca-certificates branch November 5, 2025 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants