Should allow control on whether default cert paths/files are included for verification

[shinrich]

When creating the SSL_CTX for ATS initiating connections to origin, we always call SSL_CTX_set_default_verify_path which adds the default trusted root packages on the system. You can also set your own via settings, but the default case is also added.

For a reverse proxy, the default trusted root set is probably not desirable. You probably just want to verify that your origins are signed with your small set of trusted roots. Adding more trusted roots just allows for the possibility that you accept a cert signed by someone else entirely.

There are a couple options to fix this

1. Add a new setting to ignore default trusted root
2. Don't call SSL_CTX_set_default_verify_path if a CA file or CA directory is explicitly defined.
3. The reverse proxy folks should just move the default trusted root files out of the way if they case (which is accidentally what we did).

No option is technically difficult, but probably worth a bit of discussion.

[shinrich]

Still an issue in the code.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. Marking it stale to flag it for further consideration by the community.

[grahamsedman]

Hi,

This issue was created in March 2017 and last updated in March 2022. As part of a community effort to clean up the backlog, I wanted to check if this is still relevant.

Options:

1. Still valid - Please provide an update or add a comment explaining why it should stay open
2. Fixed elsewhere - Let us know so we can close it properly
3. No longer relevant - We can close it

Thanks for your understanding. 🙏