Comment by q3k
2 days ago
It doesn't. This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots. The roots are just taken from your system.
2 days ago
It doesn't. This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots. The roots are just taken from your system.
> This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots.
Nonetheless, there shouldn't be a mechanism to override or modify the OS trust list embedded in the runtime. If the application code itself wants to do that (e.g. cert pinning), fine. But as an ops person, I repeat myself, it's an utter headache to deal with SSL trust roots already, and really I don't want to have to learn about N different ways that applications manage this crap.