CLI: Let's Encrypt Generation Y certs rejected (webpki-roots missing ISRG Root YR)

[aknochow]

The CLI bundles webpki-roots for TLS certificate verification, which uses a compiled-in copy of Mozilla's root store. This bundle does not yet include the ISRG Root YR certificate from Let's Encrypt's Generation Y hierarchy, which became the default issuance chain on May 13, 2026.

As a result, any gateway with a Let's Encrypt certificate issued after May 13 fails with:

transport error: invalid peer certificate: UnknownIssuer

This affects macOS and any platform where the OS trust store has Root YR but webpki-roots doesn't. The cross-sign chain (Root YR → ISRG Root X1) is served by the gateway but not followed by rustls with webpki-roots.

Workaround: --gateway-insecure skips cert verification but is not suitable for production.

Suggested fix: Switch from webpki-roots to rustls-platform-verifier, which uses the OS-native trust store (macOS Keychain, Linux system CA, Windows cert store). The rustls documentation recommends this for distributed applications that can't be recompiled on every CA store update.

This is a one-dependency change — rustls-platform-verifier is a drop-in replacement for the webpki-roots-based RootCertStore construction.

Environment:

• openshell CLI v0.0.83, macOS 15 (Sequoia)
• Gateway cert: Let's Encrypt, chain: EE ← YR2 ← Root YR ← ISRG Root X1
• webpki-roots v1.0.8 does not include ISRG Root YR
• OIDC auth flow works (browser handles TLS), gRPC connection fails (CLI handles TLS via rustls)

[aknochow]

Closing — further investigation shows this is not a webpki-roots issue. A different cluster with the identical cert chain (same intermediates, same root) works without --gateway-insecure. The root cause is likely in our Envoy Gateway or operator configuration, not the CLI's trust store. Apologies for the noise.