From fe4d5b9d9a0fdcf414bbe31c2fcad59e8cc03da8 Mon Sep 17 00:00:00 2001
From: Alex Pearson <alex@alexpear.com>
Date: Thu, 7 Jan 2021 10:52:13 -0500
Subject: [PATCH] fix: gracefully handle bad native certs (#520)

Instead of failing and bailing when a bad cert is found, ignore one-off
errors for bad certs and continue to load the rest of the store.

These one-off errors mostly affect MacOS users, as found in this
rustls-native-certs issue: https://github.com/ctz/rustls-native-certs/issues/4

Fixes: #519
---
 tonic/src/transport/service/tls.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tonic/src/transport/service/tls.rs b/tonic/src/transport/service/tls.rs
index f292da7..f6e2487 100644
--- a/tonic/src/transport/service/tls.rs
+++ b/tonic/src/transport/service/tls.rs
@@ -58,7 +58,10 @@ impl TlsConnector {
 
         #[cfg(feature = "tls-roots")]
         {
-            config.root_store = rustls_native_certs::load_native_certs().map_err(|(_, e)| e)?;
+            config.root_store = match rustls_native_certs::load_native_certs() {
+                Ok(store) | Err((Some(store), _)) => store,
+                Err((None, error)) => Err(error)?,
+            };
         }
 
         if let Some(cert) = ca_cert {