Function load_extra_cas

nodedb/src/control/cluster/tls.rs:210–229

Load every PEM-encoded CA certificate from `tls_dir/ca.d/*.crt`, sorted by filename for deterministic output. Missing directory is treated as "no overlap CAs" and returns an empty vec.

(tls_dir: &Path)

/// sorted by filename for deterministic output. Missing directory is
/// treated as "no overlap CAs" and returns an empty vec.
fn load_extra_cas(tls_dir: &Path) -> crate::Result<Vec<CertificateDer<'static>>> {
    let dir = tls_dir.join(CA_TRUST_DIR);
    if !dir.exists() {
        return Ok(Vec::new());
    }
    let mut entries: Vec<PathBuf> = fs::read_dir(&dir)
        .map_err(|e| crate::Error::Config {
            detail: format!("read ca.d {}: {e}", dir.display()),
        })?
        .filter_map(|r| r.ok())
        .map(|e| e.path())
        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("crt"))
        .collect();
    entries.sort();
    let mut out = Vec::with_capacity(entries.len());
    for p in entries {
        out.push(read_single_cert(&p)?);
    }
    Ok(out)
}

/// Write a PEM-encoded CA cert into `tls_dir/ca.d/<fp_hex>.crt`.
/// Called by the production applier when a `CaTrustChange { add: ... }`