Failures when trying to add .crt certificate chain with 'add_root_certificate'

[michaeljones]

We have an internal tool that was hosted on the network and required a .pem single entry root certificate to access. I could successfully perform a request to the service when I had used add_root_certificate on the client builder.

The service was taken down and re-hosted and now has a two entry certificate chain in a .crt file. The request no longer works when generating a Certificate from the file contents and using the same approach as before.

I'm using native-tls on Ubuntu 22.04. I have tried some combinations of rustls too.

Are certificate chains supported? I'm not experienced in this area. I've tried to search through the current issues, discussions and PRs. I might be falling foul of #1858 and maybe the Certificate is not being made correctly at all but only causes an error further along in the code execution.

Any help would be much appreciated.

[seanmonstar]

I haven't tried to do that, myself. Is it possible with just native-tls or rustls (without reqwest)? If so, we probably need some code to use their mechanisms.

[michaeljones]

Thank you for the quick reply. I'll try to set up a connection with those libraries and see what I can achieve and report back.

[michaeljones]

It seems that is works in our case if we split up the certificate chain into individual certificates and add each one using add_root_certificate. A colleague figured it out. I assume that add_root_certificate would not work for an intermediate cert but I can see why it is reasonable to take that approach.

Thanks again for the quick response.