Function read_system_ca_bundle

crates/openshell-supervisor-network/src/l7/tls.rs:293–304

Read the system CA bundle from well-known paths. Returns the PEM contents of the first non-empty bundle found, or an empty string if none of the well-known paths exist. Call once and pass the result to both [`write_ca_files`] and [`build_upstream_client_config`].

()

/// string if none of the well-known paths exist. Call once and pass the result
/// to both [`write_ca_files`] and [`build_upstream_client_config`].
pub fn read_system_ca_bundle() -> String {
    for path in SYSTEM_CA_PATHS {
        if let Ok(contents) = std::fs::read_to_string(path)
            && !contents.is_empty()
        {
            return contents;
        }
    }
    // No system bundle found — combined file will contain only the sandbox CA.
    // This is acceptable since the proxy uses webpki-roots independently.
    String::new()
}

/// Parse PEM certificates from a file into DER-encoded certificates.
pub fn parse_pem_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {