crypto/x509: verification with system and custom roots (backport to 1.17?)

[dims]

#16736 has been fixed in go 1.18 via https://go-review.googlesource.com/c/go/+/353589

Will the team consider back porting https://go-review.googlesource.com/c/go/+/353589 to go 1.17.x ? Is that feasible?

Context: Kubernetes/Containerd on windows has some older branches that could use this patch (example k8s 1.22.x + containerd 1.6)

Thanks,
Dims

[seankhliao]

cc @golang/security

[jayunit100]

On the sig-windows (kubernetes) side, for kubernetes, wed like to be able to use containerd for airgapped installations of windows kubelets - but without having this feature in containerd, we cannot .

[rosskirkpat]

We hit this issue in RKE2 Windows when using self-signed certs in an airgapped environment. rancher/rke2#1648
Here’s the workaround: rancher/rke2#1648 (comment)

In short - we had to import all self-signed certs into the windows root ca store. The error was seen when containerd in rke2 Windows tried to pull images from a private registry that used a self-signed cert.
Import-Certificate -FilePath "C:\Users\Administrator\ca.pem" -CertStoreLocation cert:\CurrentUser\Root

[seankhliao]

1.17 is no longer supported