Only use webpki certs despite enabled rustls-tls-native-roots feature
#1843
Comments
|
We could do something like |
|
Will make a PR shortly. |
|
We also had this need in uv and ended up doing the configuration out of reqwest: astral-sh/uv#2362. It would be great if the builder API supported this! |
charliermarsh
added a commit
to astral-sh/uv
that referenced
this issue
Mar 12, 2024
## Summary It turns out that on macOS, reading the native certificates can add hundreds of milliseconds to client initialization. This PR makes `--native-tls` a command-line flag, to toggle (at runtime) the choice of the `webpki` roots or the native system roots. You can't accomplish this kind of configuration with the `reqwest` builder API, so instead, I pulled out the heart of that logic from the crate (https://github.com/seanmonstar/reqwest/blob/e3192638518d577759dd89da489175b8f992b12f/src/async_impl/client.rs#L498), and modified it to allow toggling a choice of root. Note that there's an open PR for this in reqwest (seanmonstar/reqwest#1848), along with an issue (seanmonstar/reqwest#1843), which I may ping, but it's been around for a while and I believe reqwest is focused on its next major release. Closes #2346.
|
After a change in mind as to how exactly to expose this, there's a new PR at #2232. |
|
That looks great. We'll definitely use it. Thanks @seanmonstar! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I would like to have more fine-grained control over the root certificates added regardless of enabled crate features.
ClientBuilder::tls_built_in_root_certs()(added in #1150) only allows to disable/enable all of them.One solution would be to disable all of them and add any desired ones yourself. This didn't turn out to be ideal because
webpkioffers already parsed certificates, butClientBuilder::add_root_certificate()takes aCertificate, which only takes DER or PEM encoded certificates.Suggested Solutions
Certificate::from_rustls(), toCertificate, which takes aOwnedTrustAnchor. This would make it easy to add arbitrary root certificates torustlswithout having to serialize them to DER first, only to have them deserialized byrustlsright after.ClientBuilderallowing for more fine-grained control over which built-in certificates are added. E.g.ClientBuilder::tls_webpki_root_certs()andClientBuilder::tls_native_root_certs(). Potentially removingClientBuilder::tls_built_in_root_certs()completely in the next version.I actually find both solutions could work quite well simultaneously.
The text was updated successfully, but these errors were encountered: