From 2b4606e773a2c6de2eacd66a965c5d4a76dbd990 Mon Sep 17 00:00:00 2001 From: Lenin Alevski Date: Mon, 31 Aug 2020 21:40:33 -0700 Subject: [PATCH] fix tls certPool client regression (#263) --- restapi/tls.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/restapi/tls.go b/restapi/tls.go index 9c87cd9a6..1f0beadb8 100644 --- a/restapi/tls.go +++ b/restapi/tls.go @@ -27,9 +27,14 @@ import ( ) func getCertPool() *x509.CertPool { + rootCAs, _ := x509.SystemCertPool() + if rootCAs == nil { + // In some systems (like Windows) system cert pool is + // not supported or no certificates are present on the + // system - so we create a new cert pool. + rootCAs = x509.NewCertPool() + } caCertFileNames := getMinioServerTLSRootCAs() - // If CAs certificates are configured we save them to the http.Client RootCAs store - certs := x509.NewCertPool() for _, caCert := range caCertFileNames { pemData, err := ioutil.ReadFile(caCert) if err != nil { @@ -37,9 +42,9 @@ func getCertPool() *x509.CertPool { log.Println(err) continue } - certs.AppendCertsFromPEM(pemData) + rootCAs.AppendCertsFromPEM(pemData) } - return certs + return rootCAs } var certPool = getCertPool()