Repository navigation
Support native certificate store #275
Description
Did you search for existing issues already?
Yes
Is your feature request related to a problem? Please describe.
Yes, I can't really use this without disabling TLS validation because my company MITMs my connection and all my requests are invalid without using the certificates installed locally in my cert store.
Describe the solution you'd like
rustls doesn't support the native cert store by default, but it can if used in combination with rustls-native-certs.
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered
Another option would be to switch to native-tls which also solves this problem.
I could obviously disable TLS certs but that's not ideal obviously.
Additional context
I threw together a super quick PoC just to ensure that would actually solve my issue.
use reqwest::Client;
use rustls::ClientConfig;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
rustls::crypto::ring::default_provider()
.install_default()
.expect("Failed to install rustls crypto provider");
let mut roots = rustls::RootCertStore::empty();
for cert in rustls_native_certs::load_native_certs().expect("could not load platform certs") {
roots.add(cert).unwrap();
}
let config = ClientConfig::builder()
.with_root_certificates(roots)
.with_no_client_auth();
// Create a reqwest client with the custom TLS configuration
let client = Client::builder().use_preconfigured_tls(config).build()?;
// Make a request
let response = client.get("https://httpbin.org/get").send().await?;
println!("Status: {}", response.status());
println!("Headers:\n{:#?}", response.headers());
let body = response.text().await?;
println!("Body:\n{}", body);
Ok(())
}
Activity
Enable reqwest rustls-tls-native-roots feature
LucasPickering commentedon Jul 6, 2024
Thanks for the very detailed issue, it made it easier for me to work on this. Turns out reqwest has a feature
rustls-tls-native-rootswhich I imagine does more or less the same thing as your PoC (it also pulls in therustls-native-certscrate). Do you mind testing out the branch I made to make sure this works for you?SpyMachine commentedon Jul 6, 2024
Oh hah, didn't even think to check that! Yes, this indeed works for me :) Thank you!
LucasPickering commentedon Jul 7, 2024
Thanks for testing! I just released 1.6.0 which includes this fix
Enable reqwest rustls-tls-native-roots feature
Fix flaky http tests and improve test perf
Fix flaky http tests and improve test perf
Fix flaky http tests and improve test perf