Skip to content

Update certificate dirs and file names on FreeBSD #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
michael-o wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update certificate dirs and file names on FreeBSD #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,13 @@ const CERTIFICATE_DIRS: &[&str] = &[
"/etc/pki/tls/certs", // Fedora, RHEL
];

// see manpage of certctl(8): https://man.freebsd.org/cgi/man.cgi?query=certctl&sektion=8
Copy link
Member

@djc djc Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't find this all that helpful. The manpage mentions:

rehash	  Rebuild the list of trusted certificates by scanning all di-
		  rectories  in	 TRUSTPATH  and	 all untrusted certificates in
		  UNTRUSTPATH.	A copy of each trusted certificate  is	placed
		  in   CERTDESTDIR   and   each	  untrusted   certificate   in
		  UNTRUSTDESTDIR.   In	addition,  a  bundle  containing   the
		  trusted certificates is placed in BUNDLE.

and TRUSTPATH is defined as

TRUSTPATH       List  of	paths to search	for trusted certificates.  De-
		       fault:	 ${DESTDIR}${DISTBASE}/usr/share/certs/trusted
		       ${DESTDIR}${LOCALBASE}/share/certs/trusted
		       ${DESTDIR}${LOCALBASE}/share/certs

How do you get from this to /usr/local/etc/ssl/certs and /usr/local/openssl/certs?

// see security/openssl* ports
#[cfg(target_os = "freebsd")]
const CERTIFICATE_DIRS: &[&str] = &[
"/etc/ssl/certs", // FreeBSD 12.2+,
"/usr/local/share/certs", // FreeBSD
"/etc/ssl/certs",
"/usr/local/etc/ssl/certs",
"/usr/local/openssl/certs",
];

#[cfg(any(target_os = "illumos", target_os = "solaris"))]
Expand Down Expand Up @@ -177,7 +180,12 @@ const CERTIFICATE_FILE_NAMES: &[&str] = &[
];

#[cfg(target_os = "freebsd")]
const CERTIFICATE_FILE_NAMES: &[&str] = &["/usr/local/etc/ssl/cert.pem"];
const CERTIFICATE_FILE_NAMES: &[&str] = &[
"/etc/ssl/cert.pem",
"/usr/local/etc/ssl/cert.pem",
"/usr/local/openssl/cert.pem",
"/usr/local/share/certs/ca-root-nss.crt",
];
Comment on lines +183 to +188
Copy link
Member

@djc djc Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it makes sense to duplicate all of this here. Do all of these exist on your system? It seems to me that CERTIFICATE_FILE_NAMES is for the file that contains system-installed certificates whereas CERTIFICATE_DIRS is for user-installed certificates.


#[cfg(target_os = "dragonfly")]
const CERTIFICATE_FILE_NAMES: &[&str] = &["/usr/local/share/certs/ca-root-nss.crt"];
Expand Down