webpki

> Bundling this set with Firefox I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically. > short cut to a "Yes" Do they really do that? That's awesome if so. Then they don't even need to ship the roots. > I specifically don't like [...] saying "unknown issuer" https://github.com/briansmith/webpki/issues/221 > If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading. A more accurate analogy: You ask to open "example.txt" without supplying the path, and there i

> he situation described above just generated an "Invalid certificate" message. More use of anyhow::Context would be helpful. I don't disagree with Rustls disallowing decade-obsolete crypto. It's the "silently ignores" part that's a problem. Because of how X.509 certificate validation works, in general it's not possible to tell you why an issuer couldn't be found, because there are many possible reasons. Regardless https://github.com/briansmith/webpki/issues/206 tracks improving the situation.