cloudflare / cloudflare/quiche

Loading Native Certs on MacOS

Open
#1,649 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
11.8k
Forks
1.1k
Avg merge
21h 9m
Merged PRs (30d)
6

Description

Currently, the TLS Context loads native root CA certs on Windows & Linux, but does not load CA certs on macOS.

MacOS native certs can be loaded using the [`security-framework`][1] crate (which is what [`rustls-native-certs`][2] uses).

A potential problem is that the Apple Security Framework has to be dynamically linked. This would be transparent for users using this as a rust crate or dynamically linking. But it would require users statically linking to `quiche` to manually link with the Security Framework.

Would this be something worth adding? And if the dynamic linking is a problem, could this be added as a cargo feature to make it opt-in?

[1]: https://crates.io/crates/security-framework
[2]: https://crates.io/crates/rustls-native-certs

Contributor guide

Open the contributing guide

Research direction

Start at the TLS Context and compare how native root CA certificates are loaded on Windows and Linux. Review the security-framework and rustls-native-certs references, then determine whether macOS support needs an opt-in Cargo feature or linking guidance; done means macOS native certificates load without breaking static linking users.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, rust
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.