Menu
We are unable to use Cargo because our IT department intercepts all HTTPS traffic and replaces the certificates. I need to add the corporate root CA to Cargo's list of trusted CAs. Where is the file Cargo uses to store these?
869
This type of certificate store is local to the computer and is global to all users on the computer. This certificate store is located in the registry under the HKEY_LOCAL_MACHINE root.
The default location to install certificates is /etc/ssl/certs .
For instance, in Google Chrome, click on the lock icon in the address bar, switch to the the Connection tab and click on Certificate Information . Search for the issuer organization name. Please note that, in some cases, Certificate Authorities may delegate the signing process to subsidiaries or acquired companies.
If you are using the curl command line tool on Windows, curl will search for a CA cert file named "curl-ca-bundle. crt" in these directories and in this order: application's directory. current working directory.
I started strace cargo fetch in a random project, and it looks like, on Linux at least, cargo is just using my system certificates:
524 stat("/etc/pki/ca-trust/extracted/pem", 0x7ffccad52c70) = -1 ENOENT (No such file or directory)
529 stat("/usr/local/share/cert.pem", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
530 stat("/usr/local/share/certs.pem", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
531 stat("/usr/local/share/certs/ca-certificates.crt", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
532 stat("/usr/local/share/certs/ca-root-nss.crt", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
533 stat("/usr/local/share/certs/ca-bundle.crt", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
534 stat("/usr/local/share/CARootCertificates.pem", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
535 stat("/usr/local/share/tls-ca-bundle.pem", 0x7ffccad52da0) = -1 ENOENT (No such file or directory)
537 stat("/etc/ssl/cert.pem", {st_mode=S_IFREG|0444, st_size=220132, ...}) = 0
571 openat(AT_FDCWD, "/etc/ssl/cert.pem", O_RDONLY) = 3
/etc/ssl/cert.pem contains many certificates, and one of them is good enough for cargo by default.
The registry is hosted by default on GitHub, which is ultimately signed by "DigiCert High Assurance EV Root CA" which is indeed contained in this file.
On some distributions (although I do not know how standard that is), you can add a certificate to the system store using the command:
# trust anchor your-cert.crt
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
