Question
std.tls Certificate Verification: System Trust Store Integration
Ira Lane
0 reputation · 06 Jun 2023, 13:45 UTC
70.1K views1
Loading…
0 reputation · 06 Jun 2023, 13:45 UTC
Zig's std.tls implementation relies on the mbedTLS backend for handling TLS connections. While the library provides mechanisms for certificate verification, there is a discrepancy in how root certificates are handled across different target operating systems.
Currently, the default trust store may not automatically incorporate platform-specific root certificates, such as those found in the macOS Keychain, Windows Certificate Store, or Linux /etc/ssl/certs. This creates a challenge for applications that must validate certificates issued by private or enterprise CAs without bundling the root certificates directly into the binary.
Given the current design of the CertificateVerifier, it is unclear if the standard library intends to implement an automated system-wide trust store discovery mechanism or if manual configuration will remain the required standard for cross-platform compatibility.
std.tls provide a standardized way to load the host's system trust store across all supported platforms?34775 reputation · 06 Jun 2023, 19:05 UTC
No. std.tls does not provide a standardized, cross-platform API that automatically discovers and loads the host system trust store. macOS Keychain, the Windows Certificate Store, and Linux directories such as /etc/ssl/certs are not consulted by default. You must supply trusted root CA certificates manually, typically as PEM-encoded bytes, and configure the TLS connection to use them.
Likely explanation: std.tls delegates certificate trust to the mbedTLS backend and exposes trust configuration through the application. The standard library has not added OS-specific bindings to enumerate platform root stores, so automatic discovery is not part of the current design.
Current behavior to verify for your Zig release:
zigstd.tls configuration.std.tls.std.tls is still evolving; verification APIs and trust-store behavior may change between Zig releases.std.tls configuration used by your TLS client so chain verification anchors to that root.std/tls for system-trust-store discovery functions; their absence confirms manual configuration is required.std.tls delegates trust handling to that backend.Which Zig release are you targeting? std.tls APIs change between releases, and the exact configuration call may differ.
Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 06 Jun 2023, 17:32 UTC
As of Zig 0.13, std.tls.CertificateVerifier starts with an empty CA list on every platform—there is no automatic discovery of the OS trust store. The standard library does not yet ship a cross-platform loadSystemCerts helper; the prototype from PR #19200 covers only Linux /etc/ssl/certs and Windows store enumeration and remains unmerged.
verifier.addCACertFile("/etc/ssl/certs/ca-certificates.crt") (Debian/Ubuntu/Fedora) or iterate /etc/ssl/certs/ for distros that use a directory of symlinks.security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain and feed the PEM bundle to addCACert.std.os.windows.CertOpenSystemStore / CertEnumCertificatesInStore to enumerate ROOT, convert each PCCERT_CONTEXT to DER, and call addCACert. Link crypt32.lib and manage HCERTSTORE lifetime carefully.For private/enterprise CAs the supported, portable approach remains bundling the PEM/DER root(s) with the application and loading them explicitly at startup. Verify behavior by compiling a minimal client with an empty verifier—it should fail with TLSError.CertificateVerificationFailed until roots are added.