Comment by mschuster91
2 days ago
Why the hell does Go ship its own root CA list? This is a task for the operating system, and at the very least Windows, macOS and most flavors of Linux ship an OS-wide truststore. It's annoying enough with Java to keep stuff updated...
It doesn't. This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots. The roots are just taken from your system.
> This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots.
Nonetheless, there shouldn't be a mechanism to override or modify the OS trust list embedded in the runtime. If the application code itself wants to do that (e.g. cert pinning), fine. But as an ops person, I repeat myself, it's an utter headache to deal with SSL trust roots already, and really I don't want to have to learn about N different ways that applications manage this crap.