Consider reading the value of SSL_CERT_FILE

[Konubinix]

Hi.

I was playing with a tool called tezos-client, written in ocaml to communicate with a local development tezos node, using self signed certificates.

Although SSL_CERT_FILE points to a correct ca-certificates.crt, I realized that tezos-client did not take it into account.
After some research, I believe that this project is the used dependency to find the certificates. By looking at the code, I guess (I don't know anything about ocaml) that it reads the value of NIX_SSL_CERT_FILE to find out the ca-certificates.crt.

By using export NIX_SSL_CERT_FILE=$SSL_CERT_FILE, I have tezos-client work as expected and I will go on with this workarround for now, but IMHO it would be much better if tezos-client worked OOTB with SSL_CERT_FILE in the first place.

So, here is my suggestion, read the value of SSL_CERT_FILE as well as NIX_SSL_CERT_FILE.

My best

[hannesm]

Dear @Konubinix, thanks for your suggestion. Would you mind to point to a specification / documentation of SSL_CERT_FILE?

[Konubinix]

Hi, Hannes Mehnert ***@***.***> writes:

Dear @Konubinix, thanks for your suggestion. Would you mind to point to a specification / documentation of `SSL_CERT_FILE`?

It can be found in the documentation of openssl. https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_default_verify_paths.html May be seeing how the discussion went to add openssl environment variables in other ecosystems will help. - In rust : rustls/rustls-native-certs#16 - In golang : golang/go#14310 Actually, I am asking for the exact same thing, but in ocaml. Does this answer your question? -- Konubinix GPG Key : 7439106A Fingerprint: 5993 BE7A DA65 E2D9 06CE 5C36 75D2 3CED 7439 106A

[hannesm]

Thanks for the links, I opened #23 -- would that work fine for you?

[Konubinix]

Hi.

I'm not enough at ease with ocaml to tell, but if I understand correctly, it will do the exact same thing with SSL_CERT_FILE than it does with NIX_SSL_CERT_FILE. In that case, yes, it will work for me :-)