rustls / rustls/rustls-platform-verifier
Linux: System CA bundle watcher
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 158
- Forks
- 60
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 3
Description
Currently there is no way to reload the system CA bundle on Linux. This is different to other platforms, which use a system API and can therefor detect certificate changes dynamically.
The main motivation here, aside from platform parity, is to not having to restart applications or require more complicated setups to account for this issue. E.g. this was a problem in https://github.com/hickory-dns/hickory-dns/issues/2038.
Is it an option to implement a directory/file watcher to account for that on Linux? As this isn't really supported in rustls-native-certs, it would require using openssl-probe directly to get the paths instead of only getting the certificates.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how Linux system certificates are currently obtained and how rustls-native-certs and openssl-probe expose their paths. Determine the watcher scope, reload behavior, and platform-specific constraints before proposing an implementation. Done means Linux certificate changes can be detected without restarting applications while preserving existing verification behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100