Skip to content

Remove unused Letsencrypt root cert from rustls verifier

I think this kludge which inlines an (unused) Letsencrypt root certificate in the rtcompat rustls Verifier can be safely removed with a little bit of modification: https://gitlab.torproject.org/tpo/core/arti/-/blob/main/crates/tor-rtcompat/src/impls/rustls.rs?ref_type=heads#L173-196

It's not necessary to initialise a WebPkiServerVerifier here, the methods on it (verify_tls12_signature, verify_tls12_signature, etc) can be accessed from elsewhere in the rustls crate, which means the kludge to get it's builder to succeed (by supplying a parseable root certificate) isn't needed...