HTTPie ignores system certificates

[suhr]

Describe the bug

HTTPie does not know about certificates in /etc/ssl/certs/ca-certificates.crt.

To Reproduce Steps to reproduce the behavior:

1. Add a new CA to the system certificates
2. Run http get <resource> where resource needs the new CA
3. Run curl <resource> to see that the system certificate actually works

Expected behavior

HTTPie should know about certificates in /etc/ssl/certs/ca-certificates.crt.

Notify maintainers

@schneefux

Metadata

 - system: `"x86_64-linux"`
 - host os: `Linux 5.4.54, NixOS, 20.09.20200801.840c782 (Nightingale)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.4pre20200721_ff314f1`
 - channels(root): `"nixos-20.09pre236721.840c782d507, home-manager"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

See also: https://github.com/jakubroztocil/httpie/issues/480

[stale[bot]]

I marked this as stale due to inactivity. → More info

[AndrewKvalheim]

The httpie package uses the certificate bundle provided by python3Packages.certifi, which is already patched to use the default system certificates from the cacert package:

https://github.com/NixOS/nixpkgs/blob/9034b46dc4c7596a87ab837bb8a07ef2d887e8c7/pkgs/development/python-modules/certifi/default.nix#L27-L31

Adding a certificate via the security.pki.certificateFiles option successfully overrides the cacert package—

https://github.com/NixOS/nixpkgs/blob/9034b46dc4c7596a87ab837bb8a07ef2d887e8c7/nixos/modules/security/ca.nix#L9-L13

—but only for the generation of /etc/ssl/certs/ca-certificates.crt. Other packages that depend on cacert don’t use the override and thus fail to respect the configuration.

As a workaround, setting NIX_SSL_CERT_FILE has the desired effect:

$ NIX_SSL_CERT_FILE='/etc/ssl/certs/ca-certificates.crt' http 'https://example.localhost/'
HTTP/1.1 200 OK

[techknowlogick]

If it helps anyone else who runs into this. I've added the following shell alias to home-manager:

http = "REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt ${pkgs.httpie}/bin/http";

[donovanglover]

Should we patch this in nixpkgs instead of waiting for upstream?

As an alternative, xh is a Rust-based httpie that doesn't have this problem.