crypto/x509: add ability to reload root certificates

[dtoubelis]

Problem description:

As it can be seen on this line, root certificates loaded only once during the lifetime of the application -

go/src/crypto/x509/root.go

Line 16 in 9e5b136

once.Do(initSystemRoots)

This creates a problem when new root certificates are added. In our case, it happens on a regular basis when clients add intermediate/root certificates to the system via a separate component and then all other components that run in separate processes are expected to make use of them. This is currently not possible.

Workaround:

We are currently re-implemented Root Certificate loading logic by cutting and pasting the code from this library into our codebase and create our own certPool() for every request that requires the ca-chain refresh.

Proposed solutions:

1. Add ReloadRootCertificates() call and call it as needed - backward compatible but still the source of gotchas.
2. Do not use the global state and singleton and parse the certificate chain on each request - may have an unexpected performance impact.
3. Make the method for creating the root certificate pool public.
4. Add root certificate cache expiry timeout that can go all the way to 0 triggering cert chain reload on each request.

[dtoubelis]

Related to #35887

[ALTree]

cc @FiloSottile @katiehockman

[dajudge]

I'd like to see this issue moving forward as this is directly affecting developer's ability to react to changes in the system's certificate pool.

Is there any interest in a contribution here?

I do fancy the original posts' idea of the addition of a ReloadRootCertificates() (maybe named x509.ReloadSystemCertPool()?) function as it's backwards compatible without restrictions and offers developers to address the issue in a number of different ways, e.g.:

• reload each time before retrieving the SystemCertPool
• timer based reload
• reload triggered externally
• ...

[gopherbot]

Change https://golang.org/cl/327069 mentions this issue: crypto: allow reloading of system cert pool

[szakharchenko]

The code also loads all the certificates into memory at once, which may be suboptimal for embedded applications. Certificate root directories usually enable lookup by hash, which would be sufficient for a large number of applications.