Rustls system trust anchor loading across Linux distributions with varying certificate bundle paths

Recommended Strategy for Cross-Distribution Loading

To load system CAs consistently without requiring OpenSSL development headers at build time, use the rustls-native-certs crate. This crate avoids linking to libssl by directly parsing PEM files from common distribution paths (e.g., /etc/ssl/certs/ca-certificates.crt on Debian or /etc/pki/tls/certs/ca-bundle.crt on RHEL).

Portable Pattern for Merging System and Bundled Roots

To ensure that both enterprise CAs (from the host) and standard public CAs (via Mozilla) are honored, initialize a RootCertStore and load both sources sequentially. This prevents the application from failing when the system store is empty while still allowing local overrides.

use rustls::{RootCertStore, ClientConfig};
use std::sync::Arc;

fn create_root_store() -> RootCertStore {
    let mut root_store = RootCertStore::empty();

    // 1. Load system certificates
    if let Err(e) = rustls_native_certs::load_native_certs(&mut root_store) {
        eprintln!("Warning: Failed to load native certs: {}", e);
    }

    // 2. Merge Mozilla roots as a baseline fallback
    root_store.add_parsable_certificates(
        webpki_roots::TLS_SERVER_ROOTS
            .iter()
            .cloned()
    );

    root_store
}

Handling Empty Stores in Containerized Environments

In minimal or distroless images, rustls-native-certs may return an empty list or an error because the certificate bundle files are physically missing from the image. Since Rustls does not provide a built-in "default" store, the application must explicitly handle this state to avoid UnknownIssuer errors during the TLS handshake.

Detection and Handling:

• Detection: Check the result of load_native_certs. If it returns an error or if the resulting store contains no certificates, the environment is likely missing a CA bundle.
• Handling: Implement a tiered fallback. If native loading fails, the application should rely exclusively on webpki-roots. If the application must trust internal enterprise CAs in a distroless environment, those certificates must be baked into the image at a known path or provided via a configuration file.

Verification Steps

To verify the trust configuration, perform the following checks:

1. Public Connectivity: Attempt a TLS connection to a known public endpoint (e.g., google.com) in a scratch container to ensure webpki-roots is functioning.
2. System Integration: Run the binary on a Debian and RHEL-based host to confirm that rustls-native-certs correctly resolves the differing bundle paths.
3. Enterprise Validation: Add a custom CA to the host system store and verify the client accepts a certificate signed by that CA.

Note: Please specify if you are using a specific version of rustls (e.g., 0.21 vs 0.23), as the RootCertStore API has evolved.