From 0f382439489c009a8cac802251d6438cce042529 Mon Sep 17 00:00:00 2001 From: Benjamin Kitt Date: Tue, 28 Jul 2026 21:57:51 -0500 Subject: [PATCH] fix(tls): trust the OS certificate store on relay WebSocket connections tokio-tungstenite is built with only rustls-tls-webpki-roots, and native_websocket.rs calls bare connect_async() with no custom Connector, so the relay WebSocket trusts a compiled-in Mozilla root list and nothing else. Behind a TLS-inspecting proxy the re-signed certificate is rejected with 'invalid peer certificate: UnknownIssuer', and no keychain entry, SSL_CERT_FILE or NODE_EXTRA_CA_CERTS can influence it. This is easy to misdiagnose because HTTPS works: reqwest uses rustls-platform-verifier, which does read the OS trust store. Only the WebSocket path is affected, so the app looks healthy until the relay never connects. The two root-store features are additive (tls.rs pushes both into one RootCertStore, and the webpki branch is not gated on not(rustls-tls-native-roots)), so this preserves current behaviour and additionally honours the platform store. Signed-off-by: Benjamin Kitt --- Cargo.toml | 2 +- desktop/src-tauri/Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 3ac7ee4cce..d4eac9536b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -111,7 +111,7 @@ moka = { version = "0.12", features = ["sync"] } futures-util = "0.3" # WebSocket client (test client) -tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] } +tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots", "rustls-tls-native-roots"] } url = "2" # Property-based testing (dev-only) diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 324218a49d..a599f7fc61 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -70,7 +70,7 @@ infer = "0.19" hex = "0.4" ed25519-dalek = "=3.0.0-rc.0" tokio = { version = "1", features = ["fs", "sync", "rt", "macros", "time", "net", "io-util"] } -tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] } +tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots", "rustls-tls-native-roots"] } tokio-util = { version = "0.7", features = ["rt"] } bytes = "1" futures-util = "0.3"