Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable non default crypto config for initialization of Verifier #79

Closed
nnmkhang opened this issue Apr 8, 2024 · 2 comments
Closed

Enable non default crypto config for initialization of Verifier #79

nnmkhang opened this issue Apr 8, 2024 · 2 comments

Comments

@nnmkhang
Copy link
Contributor

nnmkhang commented Apr 8, 2024

in src/verification/windows.rs there is a check to ensure that the default CryptoProvider must be used.

Enabling custom crypto providers will allow users who want to opt out of using the rustls the ability to configure platform verifier with their own crypto provider.

From 'windows.rs` on line 427

impl Verifier {
    /// Creates a new instance of a TLS certificate verifier that utilizes the
    /// Windows certificate facilities. The rustls default [`CryptoProvider`]
    /// must be set before the verifier can be used.
    pub fn new() -> Self {
        Self {
            #[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
            test_only_root_ca_override: None,
            default_provider: OnceCell::new(),
        }
    }

and also line 448

    fn get_provider(&self) -> &CryptoProvider {
        self.default_provider
            .get_or_init(|| {
                rustls::crypto::CryptoProvider::get_default()
                    .expect("rustls default CryptoProvider not set")
                    .clone()
            })
            .as_ref()
    }

My suggestion: allow passing in a CryptoProvider to the Verifier, and default to the rustls default if no CryptoProvider is supplied.

@cpu
Copy link
Member

cpu commented Apr 9, 2024

My suggestion: allow passing in a CryptoProvider to the Verifier, and default to the rustls default if no CryptoProvider is supplied.

This sounds like a good suggestion. WDYT about #81 ?

@cpu
Copy link
Member

cpu commented Apr 10, 2024

This was resolved by #81. Thanks again for filing the issue! I'm working on a release with this feature in #88.

@cpu cpu closed this as completed Apr 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants