From 2ecec7f949c47e37656395d14a56c9a0a0e20f5e Mon Sep 17 00:00:00 2001 From: ilkonovalov Date: Thu, 23 Jul 2026 16:54:50 +0300 Subject: [PATCH] buzz-ws-client: trust platform root certificates for relay TLS connect_async uses the default TLS config, which via rustls-tls-webpki-roots trusts only the bundled Mozilla roots. Clients cannot reach a relay served behind a certificate signed by a private/internal CA (handshake fails with UnknownIssuer), and there is no runtime way to add a trusted root. Switch tokio-tungstenite to rustls-tls-native-roots so the client trusts the platform trust store (public CAs plus any operator-installed CA); in container/Helm deployments the CA can be provisioned into the container trust store with no rebuild. Signed-off-by: ilkonovalov --- Cargo.lock | 2 +- Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index b5b2605a4b..8da69b8d65 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9021,11 +9021,11 @@ dependencies = [ "futures-util", "log", "rustls", + "rustls-native-certs", "rustls-pki-types", "tokio", "tokio-rustls", "tungstenite 0.29.0", - "webpki-roots 0.26.11", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 3499285f91..2d338dac30 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -110,7 +110,7 @@ moka = { version = "0.12", features = ["sync"] } futures-util = "0.3" # WebSocket client (test client) -tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] } +tokio-tungstenite = { version = "0.29", features = ["rustls-tls-native-roots"] } url = "2" # Property-based testing (dev-only)