Brad Fitzpatrick a182b864ac tsd, all: add Sys.ExtraRootCAs, plumb through TLS dial paths ...

Add ExtraRootCAs *x509.CertPool to tsd.System and plumb it through
the control client, noise transport, DERP, and wgengine layers so
that platforms like Android can inject user-installed CA certificates
into Go's TLS verification.

tlsdial.Config now honors base.RootCAs as additional trusted roots,
tried after system roots and before the baked-in LetsEncrypt fallback.
SetConfigExpectedCert gets the same treatment for domain-fronted DERP.

The Android client will set sys.ExtraRootCAs with a pool built from
x509.SystemCertPool + user-installed certs obtained via the Android
KeyStore API, replacing the current SSL_CERT_DIR environment variable
approach.

Updates #8085

Change-Id: Iecce0fd140cd5aa0331b124e55a7045e24d8e0c2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

2026-04-07 18:10:54 -07:00

..

controlhttpcommon

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

controlhttpserver

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

client_common.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

client_js.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

client.go

tsd, all: add Sys.ExtraRootCAs, plumb through TLS dial paths

2026-04-07 18:10:54 -07:00

constants.go

tsd, all: add Sys.ExtraRootCAs, plumb through TLS dial paths

2026-04-07 18:10:54 -07:00

http_test.go

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00