Use system cert pool

Author: everesio

tls/client/roundtripper.go

@@ -35,7 +35,10 @@ func WithClientCertsStore(source *source.ClientCertsStore) RoundTripperOption {
 }
 
 func WithRootCA(cert *x509.Certificate) RoundTripperOption {
-	certPool := x509.NewCertPool()
+	certPool, err := x509.SystemCertPool()
+	if err != nil {
+		certPool = x509.NewCertPool()
+	}
 	certPool.AddCert(cert)
 	return WithRootCAs(certPool)
 }

tls/client/source/pems.go

@@ -39,7 +39,10 @@ func (s ClientPEMs) RootCAs() (*x509.CertPool, error) {
 	if len(s.RootCAsPEMBlock) == 0 {
 		return nil, nil
 	}
-	certPool := x509.NewCertPool()
+	certPool, err := x509.SystemCertPool()
+	if err != nil {
+		certPool = x509.NewCertPool()
+	}
 	if !certPool.AppendCertsFromPEM(s.RootCAsPEMBlock) {
 		return nil, errors.New("client PEMs: building client CAs failed")
 	}

tls/server/source/pems.go

@@ -40,7 +40,10 @@ func (s ServerPEMs) ClientCAs() (*x509.CertPool, error) {
 	if len(s.ClientAuthPEMBlock) == 0 {
 		return nil, nil
 	}
-	certPool := x509.NewCertPool()
+	certPool, err := x509.SystemCertPool()
+	if err != nil {
+		certPool = x509.NewCertPool()
+	}
 	if !certPool.AppendCertsFromPEM(s.ClientAuthPEMBlock) {
 		return nil, errors.New("server PEMs: building client CAs failed")
 	}