Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow using system certificate store for TLS #204

Merged
merged 1 commit into from Jun 14, 2023

Conversation

msiemens
Copy link
Contributor

Allows reqwest to use the system certificate store when validating a TLS certificate e.g. for OIDC.

Fixes #203

@brocaar
Copy link
Contributor

brocaar commented Jun 13, 2023

Thanks @msiemens, you are right. However, I think the line rustls-tls (which is an alias for rustls-tls-webpki-roots) should be replaced by rustls-tls-native-roots?

Please see:

@brocaar
Copy link
Contributor

brocaar commented Jun 13, 2023

Added to the above, I think it better to just rely on the OS CA certificates instead if of bundling CA certificates with ChirpStack. What do you think?

@msiemens
Copy link
Contributor Author

I've adapted the PR to not use the bundled certificates but only the OS certificates.

I think it better to just rely on the OS CA certificates instead if of bundling CA certificates with ChirpStack. What do you think?

I agree, especially considering that Mozilla's CA certificate collection for instance is updated multiple times a year and using the OS certificates would allow updating the certificates without having to update a running ChirpStack installation.

@brocaar brocaar merged commit d6d735c into chirpstack:master Jun 14, 2023
2 checks passed
@msiemens msiemens deleted the native-tls-certs branch June 14, 2023 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

System certificates are always ignored
2 participants