vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs(swarm): trim tuwunel internals to the operator-relevant fact

Browse source
This commit is contained in:
iris 2026-08-15 11:45:02 +02:00 • committed by mara
commit 79a02f6859
1 changed files with 4 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/swarm/ca.md
View file

@ -176,12 +176,10 @@ Two consumers, and only one of them is fine:
The consumption differs per runtime and is the part worth knowing. The consumption differs per runtime and is the part worth knowing.
tuwunel links no openssl, which makes `SSL_CERT_FILE` look inapplicable tuwunel links no openssl, which makes `SSL_CERT_FILE` look inapplicable
— it isn't. Its outbound client is `reqwest` with the `rustls` feature, — it isn't: its rustls-based TLS stack still resolves trust through the
which builds a `rustls_platform_verifier::Verifier`; because tuwunel platform certificate store on Linux, and that store honors
calls `tls_certs_merge` (additive) rather than `tls_certs_only`, the `SSL_CERT_FILE`, so the env var takes effect the same way it would for
platform roots stay alongside its compiled-in webpki set. On Linux that an OpenSSL-linked binary.
verifier resolves through `rustls-native-certs` → `openssl-probe`,
which reads `SSL_CERT_FILE`.
> ⚠️ **Concatenate; never point `SSL_CERT_FILE` at the anchor alone.** > ⚠️ **Concatenate; never point `SSL_CERT_FILE` at the anchor alone.**
> `openssl-probe` uses it *instead of* the default store, so naming > `openssl-probe` uses it *instead of* the default store, so naming