-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Attempt to add our TLS certificate to the binary #1118
Conversation
379d102
to
9c11ef6
Compare
@jhheider any ideas here? |
if i had to guess, the chain needs more intermediary certs. i'd probably:
|
i tried to compare the 4 certs you're loading against the 3 i got when exporting those three from chrome. i found
|
according to amazon, you should accept all of: https://www.amazontrust.com/repository/ |
i think you'll still need CA1, of course. x509 certs are the worst, but they work (i suppose). |
So we can work on Linux without ca-certs installed. TODO, we will need to check for updates to these root certs periodically. I dunno how often.
Beautiful. Thank you. Added all the certs at that link and boom! it works. We no longer need ca-certs installed on linux to work. |
I knew it had to be possible to make it work. That doesn't make me any less impressed or surprised that it did work. |
On Mac and Windows we use the ca-certs provided by the vendor and we trust them to keep them valid. On Linux we would still prefer the system provide them but we want to *just work* in minimal containers.
Since we allow configurable endpoints in |
So we can work on Linux without ca-certs installed.
TODO, update this regularly…