From 79a02f68592af23684082fb02c176688285bb526 Mon Sep 17 00:00:00 2001 From: iris Date: Sat, 15 Aug 2026 11:45:02 +0200 Subject: [PATCH] docs(swarm): trim tuwunel internals to the operator-relevant fact --- docs/swarm/ca.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md index 537087f9..5db8d4e8 100644 --- a/docs/swarm/ca.md +++ b/docs/swarm/ca.md @@ -176,12 +176,10 @@ Two consumers, and only one of them is fine: The consumption differs per runtime and is the part worth knowing. tuwunel links no openssl, which makes `SSL_CERT_FILE` look inapplicable - — it isn't. Its outbound client is `reqwest` with the `rustls` feature, - which builds a `rustls_platform_verifier::Verifier`; because tuwunel - calls `tls_certs_merge` (additive) rather than `tls_certs_only`, the - platform roots stay alongside its compiled-in webpki set. On Linux that - verifier resolves through `rustls-native-certs` → `openssl-probe`, - which reads `SSL_CERT_FILE`. + — it isn't: its rustls-based TLS stack still resolves trust through the + platform certificate store on Linux, and that store honors + `SSL_CERT_FILE`, so the env var takes effect the same way it would for + an OpenSSL-linked binary. > ⚠️ **Concatenate; never point `SSL_CERT_FILE` at the anchor alone.** > `openssl-probe` uses it *instead of* the default store, so naming