Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
proposal: x509.Certificate.Verify should provide an option for both using the host's root CA set and an additional set of user-provided root CAs #34937
(similar thing would apply to tls.Config's RootCAs option)
Currently, you can attempt to do this by getting SystemCertPool() and then adding additional certs to this pool, and then setting this as the Roots member. One problem with this is on Windows, where SystemCertPool() does not work. Even if you try to work around this by implementing your own SystemCertPool for Windows (via CertEnumCertificatesInStore etc), it could be incomplete due to Windows' behavior of adding trusted roots to its store on-demand.
The neat thing is that Go's systemVerify (called when no *CertPool is given) will use the Windows CryptoAPI, which during the verification process will pull in trusted root CAs into the Windows store if they are not there already. With this in mind, changing the capabilities of tls.Config (and x509.VerifyOptions) to take not only a *CertPool but also a flag that indicates if the system roots should be used as well, would give more capabilities to Go programs built for Windows.
By the time you are calling x509.Certificate.Verify, it should be easy to call it twice, once with your roots and once with the system ones. The hard part is getting to x509.Certificate.Verify from crypto/tls, but tls.Config is already overcrowded and we are not adding a knob there.
I agree #16736 is unfortunate, and we should try fixing it again if the OS provides what we need.
Is there any case in which making two calls to x509.Certificate.Verify wouldn't work, aside from crypto/tls without VerifyPeerCertificate?