UnknownIssuer error with private CA

[austinbutler]

With a private CA chain added to /etc/pki/tls/certs/ca-bundle.crt I get error trying to connect: invalid certificate: UnknownIssuer. The same request works with curl or httpie. If I use the --native-tls flag with xh it works.

Without being all that familiar with rustls, two potential suggestions:

1. Better documentation around how SSL certs are found/used?
2. Integrate rustls-native-certs so that system certificate store just works?

[ducaale]

By default, the reqwest library uses webpki-roots but can also integrate with rustls-native-certs via the rustls-native-certs feature.

@austinbutler can you try compiling xh after adding both rustls-tls-webpki-roots and rustls-tls-native-roots to reqwests's enabled features? thanks

[dependencies.reqwest]
version = "0.11.6"
default-features = false
- features = ["rustls-tls", "json", "gzip", "brotli", "deflate", "multipart", "blocking", "socks", "cookies"]
+ features = ["rustls-tls", "rustls-tls-webpki-roots", "rustls-tls-native-roots", "json", "gzip", "brotli", "deflate", "multipart", "blocking", "socks", "cookies"]

[austinbutler]

Yep that seems to do it. Should I open a PR?

[ducaale]

Yes, that would be very much appreciated!

[ducaale]

This is now fixed in xh v0.15.0