Skip to content

By default use default system paths for SSL CA #320

@nmaludy

Description

@nmaludy

Currently SSL verification only works if you explicitly set the ca_trust_path on a connection. If i try to connect without setting it, i get an error that it can't establish SSH trust (with verification) even though the CA certificate is in my system's CA store (/etc/pki/tls/cert.pem).

If i explicitly set ca_trust_path: '/etc/pki/tls/cert.pem', then the connection works just fine with SSL verification enabled.

It looks like in order to support looking for CA certs in the default system paths, we would need to call

@httpcli.ssl_config.set_default_paths

Here, i think? https://github.com/WinRb/WinRM/blob/master/lib/winrm/http/transport.rb#L26

Reference: https://makandracards.com/makandra/50532-making-httpclient-use-the-operating-system-s-ssl-cert-store

If this sounds reasonable, i'll happily make a PR!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions