Support full certificate chain loading from CA bundles (#279) #282
+118
−2
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #279
Summary
This PR updates the CA-loading logic so that to_ca_certs() parses and loads all PEM certificates found in a provided CA bundle file instead of stopping after the first PEM block. Many users supply CA bundles containing multiple certificates (root + intermediates or multiple roots for different services), and only loading the first certificate caused TLS verification failures for servers relying on subsequent certificates in the bundle.
What changed
Why
Loading the full certificate chain from CA bundles ensures proper trust chain verification when intermediate or multiple CA certificates are present in the same file. This preserves backward compatibility for single-certificate files while fixing failures caused by incomplete CA loading.
Files changed (high level)
Testing
cargo test --all-features).References
This change uses the auto-closing keyword above to close the referenced issue when merged.