add: additional key path for macos#28
Conversation
|
Thanks for your contribution, I had some minor remarks. Would be great to address them, then I can merge and cut a release. |
On MacOS it's normal[1] to add custom certificates to `/Library/Keychains/System.keychain` in addition to `/System/Library/Keychains/SystemRootCertificates.keychain`. This PR now checks both locations and concatenates them [1] https://apple.stackexchange.com/questions/53579/how-is-the-system-keychain-secured-in-os-x
202997c to
053648f
Compare
|
I took the liberty to rebase to main and update the code as reviewed. |
|
The remaining question I have is: from your linked stackoverflow article, "The System Keychain, /Library/Keychains/System.keychain, is a special Keychain for Apple and daemons to use. You should generally avoid using it for user level scripts." So, are you sure that path should be added by default to the root certificates / trust anchors? Is there some authoritative documentation (from Apple) suggesting this? I'm not sure I follow your changes, and think that #20 is related -- so anyone with a macOS machine and some binding experience, it would be great to use the macOS API instead of |
|
I dug around and couldn't find anything on what to do with ssl certificates specifically, it looks like there is a per-user keychain though, so we could try using that one w/the apple API. But in general all of the programs I've used that require self signed certs (i.e proxies) usually ask users to use the system keychain |
|
Thanks for your research. When you say "all of the programs I've used that require self signed certs (i.e proxies) usually ask users to use the system keychain", are those being installed into |
|
After some time passed by, I'm fine to merge this finally. Thanks a lot. If there's any drawback, I'm sure some macOS user will report. |
CHANGES: * Add OCAML_EXTRA_CA_CERTS env variable (mirage/ca-certs#30 @art-w) * macOS: add additional keychain path `/Library/Keychains/System.keychain` (mirage/ca-certs#28 @ajbt200128) * Demote log levels of trust anchor parsing failures (now on the debug level), log a single warning message how many failures occured (mirage/ca-certs#36 @Julow)
On MacOS it's normal[1] to add custom certificates to
/Library/Keychains/System.keychainin addition to/System/Library/Keychains/SystemRootCertificates.keychain. This PR now checks both locations and concatenates them[1] https://apple.stackexchange.com/questions/53579/how-is-the-system-keychain-secured-in-os-x