Unknown issuer on tls handshake in Rust with async-tls

user_11514950 0
Viewed 1865

I was building my client-server application with async-tls doing something really similar to the examples but when I try to perform the TLS handshake it panics with this error:

thread 'main' panicked at 'Awaiting TLS failed: Custom { kind: InvalidData, error: WebPKIError(UnknownIssuer) }', src/main.rs:15:26
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

My code in the client is simply:

let tcp_stream = TcpStream::connect("localhost:5568")
    .await
    .expect("TCP handshake failed.");

let tls_connector = TlsConnector::default();
let mut tls_stream = tls_connector
    .connect("localhost", tcp_stream)
    .expect("TLS handshake failed.")
    .await
    .expect("Awaiting TLS failed");

Also I've copied the CA certificate under /usr/local/share/ca-certificates/ and ran sudo update-ca-certificates (linux of course). Any idea of what I'm doing wrong? Thanks.

rust backend ssl
1 Answers

I was using rustls which doesn't integrate OS certificates.

Solved with this:

let mut config = ClientConfig::new();

let cafile = Path::new("path of trusted CA chain");
let file = async_std::fs::read(cafile)
    .await
    .expect("Failed to read file.");
let mut pem = Cursor::new(file);
config
    .root_store
    .add_pem_file(&mut pem)
    .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "invalid cert"))
    .expect("Unable to create configuration object.");

let tls_connector = TlsConnector::from(Arc::new(config));

Thanks u/Wilem82 (from reddit) for the hint.

user_115149500
Related