minio/pkg/certs/ca-certs.go

// Copyright (c) 2015-2021 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package certs

import (
	"crypto/x509"
	"io/ioutil"
	"os"
	"path"
)

// GetRootCAs - returns all the root CAs into certPool
// at the input certsCADir
func GetRootCAs(certsCAsDir string) (*x509.CertPool, error) {
	rootCAs, _ := loadSystemRoots()
	if rootCAs == nil {
		// In some systems system cert pool is not supported
		// or no certificates are present on the
		// system - so we create a new cert pool.
		rootCAs = x509.NewCertPool()
	}

	fis, err := ioutil.ReadDir(certsCAsDir)
	if err != nil {
		if os.IsNotExist(err) || os.IsPermission(err) {
			// Return success if CA's directory is missing or permission denied.
			return rootCAs, nil
		}
		return rootCAs, err
	}

	// Load all custom CA files.
	for _, fi := range fis {
		caCert, err := ioutil.ReadFile(path.Join(certsCAsDir, fi.Name()))
		if err == nil {
			rootCAs.AppendCertsFromPEM(caCert)
		}
		// ignore files which are not readable.
	}

	return rootCAs, nil
}