Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Attempt to add our TLS certificate to the binary #1118

Merged
merged 2 commits into from
Feb 14, 2025
Merged

Attempt to add our TLS certificate to the binary #1118

merged 2 commits into from
Feb 14, 2025

Conversation

mxcl
Copy link
Member

@mxcl mxcl commented Feb 10, 2025

So we can work on Linux without ca-certs installed.

TODO, update this regularly…

@coveralls
Copy link

coveralls commented Feb 10, 2025

Coverage Status

coverage: 89.952% (+0.08%) from 89.877%
when pulling 99da836 on embed-pem-cert
into 830955d on main.

@mxcl mxcl force-pushed the embed-pem-cert branch 10 times, most recently from 379d102 to 9c11ef6 Compare February 11, 2025 15:34
@mxcl
Copy link
Member Author

mxcl commented Feb 11, 2025

@jhheider any ideas here?

@jhheider
Copy link
Contributor

jhheider commented Feb 11, 2025

if i had to guess, the chain needs more intermediary certs. i'd probably:

  • a) prove to myself that I can verify that cert with just the root ca (openssl command line, ignoring system certs)
  • b) test that the cert can be built and verified in build.rs, so you know at build time.

chrome shows a chain of 3 certs:
Screenshot 2025-02-11 at 15 02 10

@jhheider
Copy link
Contributor

i tried to compare the 4 certs you're loading against the 3 i got when exporting those three from chrome. i found Amazon Root CA 1 in amazon_root_ca1.pem, and the dist cert (which... we shouldn't need. we should only the need the CA chain, right?). i didn't find Amazon RSA 2048 M02, which i'll reproduce here:

-----BEGIN CERTIFICATE-----
MIIEXjCCA0agAwIBAgITB3MSSkvL1E7HtTvq8ZSELToPoTANBgkqhkiG9w0BAQsF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAxMB4XDTIyMDgyMzIyMjUzMFoXDTMwMDgyMzIyMjUzMFowPDEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEcMBoGA1UEAxMTQW1hem9uIFJT
QSAyMDQ4IE0wMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtDGMZa
qHneKei1by6+pUPPLljTB143Si6VpEWPc6mSkFhZb/6qrkZyoHlQLbDYnI2D7hD0
sdzEqfnuAjIsuXQLG3A8TvX6V3oFNBFVe8NlLJHvBseKY88saLwufxkZVwk74g4n
WlNMXzla9Y5F3wwRHwMVH443xGz6UtGSZSqQ94eFx5X7Tlqt8whi8qCaKdZ5rNak
+r9nUThOeClqFd4oXych//Rc7Y0eX1KNWHYSI1Nk31mYgiK3JvH063g+K9tHA63Z
eTgKgndlh+WI+zv7i44HepRZjA1FYwYZ9Vv/9UkC5Yz8/yU65fgjaE+wVHM4e/Yy
C2osrPWE7gJ+dXMCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
VR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNV
HQ4EFgQUwDFSzVpQw4J8dHHOy+mc+XrrguIwHwYDVR0jBBgwFoAUhBjMhTTsvAyU
lC4IWZzHshBOCggwewYIKwYBBQUHAQEEbzBtMC8GCCsGAQUFBzABhiNodHRwOi8v
b2NzcC5yb290Y2ExLmFtYXpvbnRydXN0LmNvbTA6BggrBgEFBQcwAoYuaHR0cDov
L2NydC5yb290Y2ExLmFtYXpvbnRydXN0LmNvbS9yb290Y2ExLmNlcjA/BgNVHR8E
ODA2MDSgMqAwhi5odHRwOi8vY3JsLnJvb3RjYTEuYW1hem9udHJ1c3QuY29tL3Jv
b3RjYTEuY3JsMBMGA1UdIAQMMAowCAYGZ4EMAQIBMA0GCSqGSIb3DQEBCwUAA4IB
AQAtTi6Fs0Azfi+iwm7jrz+CSxHH+uHl7Law3MQSXVtR8RV53PtR6r/6gNpqlzdo
Zq4FKbADi1v9Bun8RY8D51uedRfjsbeodizeBB8nXmeyD33Ep7VATj4ozcd31YFV
fgRhvTSxNrrTlNpWkUk0m3BMPv8sg381HhA6uEYokE5q9uws/3YkKqRiEz3TsaWm
JqIRZhMbgAfp7O7FUwFIb7UIspogZSKxPIWJpxiPo3TcBambbVtQOcNRWz5qCQdD
slI2yayq0n2TXoHyNCLEH8rpsJRVILFsg0jc7BaFrMnF462+ajSehgj12IidNeRN
4zl+EoNaWdpnWndvSpAEkq2P
-----END CERTIFICATE-----

@jhheider
Copy link
Contributor

according to amazon, you should accept all of: https://www.amazontrust.com/repository/

@jhheider
Copy link
Contributor

i think you'll still need CA1, of course. x509 certs are the worst, but they work (i suppose).

So we can work on Linux without ca-certs installed.

TODO, we will need to check for updates to these root certs periodically. I dunno how often.
@mxcl
Copy link
Member Author

mxcl commented Feb 14, 2025

Beautiful. Thank you. Added all the certs at that link and boom! it works. We no longer need ca-certs installed on linux to work.

@jhheider
Copy link
Contributor

I knew it had to be possible to make it work. That doesn't make me any less impressed or surprised that it did work.

On Mac and Windows we use the ca-certs provided by the vendor and we trust them to keep them valid.

On Linux we would still prefer the system provide them but we want to *just work* in minimal containers.
@jhheider
Copy link
Contributor

Since we allow configurable endpoints in build.rs, you could probably conditionally pull them in (or even others) at build time.

@mxcl mxcl merged commit 1bb4fe5 into main Feb 14, 2025
13 of 14 checks passed
@mxcl mxcl deleted the embed-pem-cert branch February 14, 2025 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants