Support loading custom CAs (`--ca-cert`, `--ca-path`) by nikneym · Pull Request #2891 · lightpanda-io/browser

nikneym · 2026-07-06T09:28:01Z

Addresses #2877, custom CA certs and directories can be provided via --ca-cert and --ca-path.

In order to test, you can grab Mozilla CA store in PEM format from curl's website; then execute this:

lightpanda fetch "https://lightpanda.io/" --ca-cert <PEM> --dump > output.html

karlseguin · 2026-07-09T02:55:43Z

+    // Report back if no certificates loaded.
+    defer {
+        const num_of_certs = crypto.getCertCount(store);
+        if (num_of_certs == 0) {


If --ca-path is hash directory, this will incorrectly warn.

karlseguin · 2026-07-09T02:59:26Z

+        }
+    }
+
+    load_custom_ca: switch (config.mode) {


In the end, did we decide that if --ca-path or -ca-cert was specified, we'd continue to load the system certs too?

I think we didn't, loading only what's provided would probably be the desired behavior.

karlseguin · 2026-07-09T03:01:36Z

    .{ .name = "v8_flags_unsafe", .type = ?[]const u8 },
    .{ .name = "v8_max_heap_mb", .type = ?u32 },
+    .{ .name = "ca_cert", .type = [:0]const u8, .multiple = true },
+    .{ .name = "ca_path", .type = [:0]const u8, .multiple = true, .validator = caPathValidator },


It's a bit inconsistent that a bad ca_path stops the app from starting, but a bad ca_cert only warns at a later time.

Agreed. I think we can either try parsing ca_cert in Config and store or make both warn at a later time.

Parsing before creating the store requires us to store the X509 pointers in somewhere though; so, if we can add something like this to Config, we can distinguish internal representation and CLI expectation.

.{ .name = "ca_cert", .type = .{ .cli = [:0]const u8, .memory = *crypto.X509, }, .multiple = true, },

Which would expect [:0]const u8 from CLI but prefer std.ArrayList(*crypto.X509) in internal store.

Or, we can just parse 2 times; one in Config and the other at X509 store creation time.

We still have inconsistency here:

invalid ca-path: the process doesn't start

invalid ca-cert: the process starts w/ a warning "Invalid CA cert" but idk if we loaded the system's cert or if we disabled tls validation.

I think we should stop in both cases.

I think we should stop in both cases.

Agreed, will match the behavior of both.

karlseguin · 2026-07-09T03:04:54Z

+        return error.InvalidArgument;
+    }
+
+    return list.append(allocator, dir);


in cli.zig, the documentation says that strings are "duped from argv". So I assume if they have to be duped there, it has to be duped here?

karlseguin · 2026-07-09T03:05:23Z

zig build run -- fetch --ca-path ca-test https://example.com crashes

krichprollsch · 2026-07-20T08:07:23Z

+        },
+        .help => unreachable,
+        .version => {}, // Don't load custom CA for version command.
+    }


Move the switch into a Config's accessors instead keeping it in Network.
Somehting like caCerts and caCertDirs.

krichprollsch · 2026-07-20T08:10:15Z

+    comp: OPENSSL_sk_cmp_func,
+};
+pub const _STACK = struct_stack_st;
+pub extern fn sk_num(sk: [*c]const _STACK) usize;


Claude complaints about this use:

2. The sk_num binding is unmodified translate-c output and uses a deprecated symbol. (src/sys/libcrypto.zig:356-368, 395-404) - struct_stack_st is declared but never dereferenced — only used as a @ptrCast target. It's a silent trap if someone later reads a field and the layout has drifted. Delete it. - sk_X509_OBJECT_num is Zig-only but declared callconv(.c) with a pointless const sk = arg_sk;. Compare findDigest at the bottom of the same file for the hand-written style. - sk_num is OPENSSL_DEPRECATED (stack.h:302). OPENSSL_sk_num (stack.h:257) is the supported name with the identical size_t signature, and returns 0 for NULL — so the whole thing is three lines with no null check needed.

WDYT?

I think we can do counting by ourselves, though there shouldn't be any deprecation notice on sk_num on BoringSSL.

krichprollsch · 2026-07-20T08:18:27Z

    .{ .name = "v8_flags_unsafe", .type = ?[]const u8 },
    .{ .name = "v8_max_heap_mb", .type = ?u32 },
+    .{ .name = "ca_cert", .type = [:0]const u8, .multiple = true },
+    .{ .name = "ca_path", .type = [:0]const u8, .multiple = true, .validator = caPathValidator },


We still have inconsistency here:

invalid ca-path: the process doesn't start

invalid ca-cert: the process starts w/ a warning "Invalid CA cert" but idk if we loaded the system's cert or if we disabled tls validation.

I think we should stop in both cases.

* bind `X509_STORE_get0_objects`, * bind `sk_num`, * bind `sk_X509_OBJECT_num`, * add `getCertCount` helper.

Unifies how we report empty stores by checking directly on `X509_STORE`.

BoringSSL is fine with that still.

Storage fields can now be shared by CLI arguments; also having a different type for internal representation and CLI is also added.

Returns a pointer to `X509_STORE` if custom CA supplied, else null.

nikneym requested review from karlseguin and krichprollsch July 6, 2026 09:28

nikneym force-pushed the nikneym/custom-cert-load branch from e042e4c to 63d96c3 Compare July 6, 2026 10:02

karlseguin reviewed Jul 6, 2026

View reviewed changes

Comment thread src/network/Network.zig Outdated

Comment thread src/help.zon Outdated

Comment thread src/Config.zig Outdated

nikneym force-pushed the nikneym/custom-cert-load branch 2 times, most recently from 6ad0702 to 50c5977 Compare July 8, 2026 11:49

nikneym requested a review from karlseguin July 8, 2026 11:49

nikneym changed the title ~~Custom CAs (--ca-cert, --ca-path) + flag for disabling root CA~~ Support loading custom CAs (--ca-cert, --ca-path) Jul 8, 2026

karlseguin reviewed Jul 9, 2026

View reviewed changes

nikneym force-pushed the nikneym/custom-cert-load branch from 50c5977 to e279307 Compare July 15, 2026 12:24

nikneym requested a review from karlseguin July 15, 2026 12:24

krichprollsch reviewed Jul 20, 2026

View reviewed changes

nikneym force-pushed the nikneym/custom-cert-load branch from e279307 to 3e8a0e1 Compare July 21, 2026 19:56

nikneym marked this pull request as draft July 22, 2026 12:53

nikneym force-pushed the nikneym/custom-cert-load branch from ec80029 to efc0c26 Compare July 22, 2026 14:55

nikneym marked this pull request as ready for review July 22, 2026 14:55

nikneym requested a review from krichprollsch July 22, 2026 14:55

nikneym marked this pull request as draft July 22, 2026 14:58

nikneym added 11 commits July 22, 2026 18:29

Network: support custom CA install

b7f61e5

Config: ensure passed --ca-path paths contain hashed certs

1157020

Network: prefer Config.isHashedDirectory for consistency

3c4d098

Config: remove unnecessary import

bf916e7

help.zon: obey alphabetical order

fdb90a8

Config: drop local in hashed dir check

1b15985

remove --disable-root-certificates flag

d6ce373

crypto: more bindings

1c97bc4

* bind `X509_STORE_get0_objects`, * bind `sk_num`, * bind `sk_X509_OBJECT_num`, * add `getCertCount` helper.

createX509Store: skip custom CA loading if none given

2a53b1e

createX509Store: report if no certificates loaded

71536de

Unifies how we report empty stores by checking directly on `X509_STORE`.

Config: dupe received dir from arg iterator

03cfdbe

nikneym added 11 commits July 22, 2026 18:29

update createX509Store in all call sites

1429202

createX509Store: track hashed directories separately

6f828cb

Config: fix crash related to absolute paths

cbaef30

BoringSSL is fine with that still.

cli: introduce shared fields

83d3fb4

Storage fields can now be shared by CLI arguments; also having a different type for internal representation and CLI is also added.

Config: cert store creation is done in Config if custom CA given

6a9a1f9

Config: remove dead isHashedDirectory function

0e32b9c

Config: add customCertStore helper

4eeb9f5

Returns a pointer to `X509_STORE` if custom CA supplied, else null.

Network: rework how CA stores are created

f18d958

changes for Zig 0.16

9d6c54a

libcrypto: remove dead bindings

b791512

changes for Zig 0.16 (again)

a4ba95b

nikneym force-pushed the nikneym/custom-cert-load branch from 689248c to a4ba95b Compare July 22, 2026 15:29

nikneym marked this pull request as ready for review July 22, 2026 15:29

krichprollsch added 2 commits July 23, 2026 10:33

adjust help for --ca-* options

45c8f74

remove dead condition

b90d9de

krichprollsch merged commit 1d3e961 into main Jul 23, 2026
26 checks passed

krichprollsch deleted the nikneym/custom-cert-load branch July 23, 2026 09:33

github-actions Bot locked and limited conversation to collaborators Jul 23, 2026

Uh oh!

Conversation

nikneym commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nikneym Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nikneym Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karlseguin commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nikneym commented Jul 6, 2026 •

edited

Loading

nikneym Jul 15, 2026 •

edited

Loading

nikneym Jul 21, 2026 •

edited

Loading

karlseguin commented Jul 9, 2026 •

edited

Loading