crypto/x509: failed to load system roots and no roots provided.

[gopherbot]

by introkun:

Distro is OpenELEC that run on Raspberry PI (ARM).

go version is 1.03beta

Error: x509: failed to load system roots and no roots provided.
Go tries to found CA certificates here:
"/etc/ssl/certs/ca-certificates.crt",     // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",       // Fedora/RHEL
"/etc/ssl/ca-bundle.pem",                 // OpenSUSE
"/etc/ssl/cert.pem",                      // OpenBSD
"/usr/local/share/certs/ca-root-nss.crt", // FreeBSD/DragonFly

But CA bundle on OpenELEC is located here: /etc/pki/tls/cacert.pem

Devs, could you please add the path also to codebase? Thank you.

[ianlancetaylor]

Comment 1:

It is really necessary for OpenELEC to introduce yet another place to store certs? 
Isn't this going to require a lot of code to be updated to run correctly on that distro?

Labels changed: added repo-main, release-go1.4.

[gopherbot]

Comment 2 by introkun:

OpenELEC is based on squashfs (read-only fs). You should unpack OS, add symlink, pack OS
back and install to device. It took around half an hour if you know how to do it. But
after each OS update you shoul do it again...

[minux]

Comment 3:

does OpenELEC has openssl executable by default?
I think we can add a catch-all case that invokes "openssl version -d"
and use OPENSSLDIR/certs/ca-certificates.crt.
This should solve the uncommon certificates location problem once and
for all (if openssl is installed)
Another solution would be to grep "#define OPENSSLDIR" in
/usr/include/openssl/opensslconf.h, but i expect that not all system
will install openssl development headers.

[gopherbot]

Comment 4 by introkun:

1. Yes. OpenSSL is there:
kitpi:~ # openssl version -d
OPENSSLDIR: "/etc/pki/tls"
kitpi:~ # ls -lah /etc/pki/tls
total 262
drwxrwxr-x    2 root     root          52 May 28 03:25 .
drwxrwxr-x    3 root     root          26 May 28 03:25 ..
-rw-rw-r--    1 root     root      250.8K May 28 03:25 cacert.pem
-rw-r--r--    1 root     root       10.6K May 28 03:25 openssl.cnf
2. >> /usr/include/openssl/opensslconf.h
There is no such path/file.

[minux]

Comment 5:

ok, so OpenELEC really is different.
we will need to search for these files under OPENSSLDIR/:
certs/ca-certificates.crt
cacert.pem

[davecheney]

Comment 6:

I don't think it's a large burdon to add another entry at the bottom of the list.

[rsc]

Comment 7:

If this is going to happen it needs to happen soon. Otherwise 1.5.

Status changed to Accepted.

[davecheney]

Comment 8:

@introkun, would you please test https://golang.org/cl/147320043 _immediately_
so we can propose it for inclusion in Go 1.4

[gopherbot]

Comment 9 by introkun:

Tested. Works fine now.

[davecheney]

Comment 10:

This issue was closed by revision 19104dc.

Status changed to Fixed.