Self signed CAfile are rejected

[kali]

Maybe I'm missing something, but self-signed CAfile are accepted by openssl, while being rejected by webpki. Steps to reproduce (using rustls):

$ curl http://test.mosquitto.org/ssl/mosquitto.org.crt -O
$ openssl s_client -connect test.mosquitto.org:8883 -CAfile mosquitto.org.crt
[...]
Verify return code: 0 (ok)
[...]
$ echo "" | cargo run --example tlsclient -- --cafile mosquitto.org.crt -p 8883 --verbose test.mosquitto.org
[...]
TLS error: WebPKIError(UnknownIssuer)
[...]

As far as I can tell, the failing test is the one here https://github.com/briansmith/webpki/blob/master/src/verify_cert.rs#L91 .

[kali]

I think I have a better understanding of what is happening now. Mosquitto.org self-signed CA certificate use SHA1+RSA1024, which is too weak for rustls.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 16211512772147321020 (0xe0fadcf9578c98bc)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=GB, ST=United Kingdom, L=Derby, O=Mosquitto, OU=CA, CN=mosquitto.org/emailAddress=roger@atchoo.org
        Validity
            Not Before: Jun 29 22:11:59 2012 GMT
            Not After : Jun 27 22:11:59 2022 GMT
        Subject: C=GB, ST=United Kingdom, L=Derby, O=Mosquitto, OU=CA, CN=mosquitto.org/emailAddress=roger@atchoo.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c6:24:2e:65:fb:4a:a3:93:fe:32:42:66:84:35:
                    35:67:42:ae:bf:e9:ab:8e:e6:df:1c:72:5d:c2:3e:
                    14:b1:26:c1:b1:37:47:db:cc:ac:4e:ac:45:b3:f6:
                    4b:cf:69:7e:b0:ad:ee:2b:88:4d:73:ca:c9:ca:54:
                    70:85:34:9a:d7:13:d4:ea:b1:18:15:76:95:be:91:
                    68:e4:f6:80:2e:69:c7:21:9a:14:9f:a1:03:e1:88:
                    6d:d6:0a:3b:72:69:ac:fc:52:06:84:69:a2:76:49:
                    bc:31:84:66:e3:37:37:ba:77:4b:f9:51:a2:2e:c6:
                    e7:01:b9:9a:f5:26:68:4e:51
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DA:77:64:27:79:5C:ED:20:F4:33:45:11:A3:E9:91:CA:A8:94:EF:E6
            X509v3 Authority Key Identifier:
                keyid:DA:77:64:27:79:5C:ED:20:F4:33:45:11:A3:E9:91:CA:A8:94:EF:E6

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
         0a:b0:d6:b2:b8:36:54:54:09:40:4b:84:41:54:41:ab:23:3f:
         bc:5f:16:a9:55:6c:4d:9c:47:2d:11:b3:8a:37:29:2d:09:c3:
         34:15:07:01:bc:e7:18:1e:44:4c:8f:38:57:46:76:10:58:d8:
         fd:45:35:1c:b4:30:3a:fa:c6:bf:83:d9:93:b0:c6:ce:b7:74:
         6d:67:9c:09:d6:66:0e:ea:c2:82:e0:a5:9e:1f:11:23:c3:dc:
         f9:00:d5:98:0a:25:cd:b3:6d:24:3d:7c:23:f1:b7:65:b7:99:
         d5:5a:bf:ae:9c:e9:fb:1b:ed:e9:6c:d9:6d:88:cf:b8:04:44:
         94:97
-----BEGIN CERTIFICATE-----
MIIC8DCCAlmgAwIBAgIJAOD63PlXjJi8MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYD
VQQGEwJHQjEXMBUGA1UECAwOVW5pdGVkIEtpbmdkb20xDjAMBgNVBAcMBURlcmJ5
MRIwEAYDVQQKDAlNb3NxdWl0dG8xCzAJBgNVBAsMAkNBMRYwFAYDVQQDDA1tb3Nx
dWl0dG8ub3JnMR8wHQYJKoZIhvcNAQkBFhByb2dlckBhdGNob28ub3JnMB4XDTEy
MDYyOTIyMTE1OVoXDTIyMDYyNzIyMTE1OVowgZAxCzAJBgNVBAYTAkdCMRcwFQYD
VQQIDA5Vbml0ZWQgS2luZ2RvbTEOMAwGA1UEBwwFRGVyYnkxEjAQBgNVBAoMCU1v
c3F1aXR0bzELMAkGA1UECwwCQ0ExFjAUBgNVBAMMDW1vc3F1aXR0by5vcmcxHzAd
BgkqhkiG9w0BCQEWEHJvZ2VyQGF0Y2hvby5vcmcwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMYkLmX7SqOT/jJCZoQ1NWdCrr/pq47m3xxyXcI+FLEmwbE3R9vM
rE6sRbP2S89pfrCt7iuITXPKycpUcIU0mtcT1OqxGBV2lb6RaOT2gC5pxyGaFJ+h
A+GIbdYKO3JprPxSBoRponZJvDGEZuM3N7p3S/lRoi7G5wG5mvUmaE5RAgMBAAGj
UDBOMB0GA1UdDgQWBBTad2QneVztIPQzRRGj6ZHKqJTv5jAfBgNVHSMEGDAWgBTa
d2QneVztIPQzRRGj6ZHKqJTv5jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
A4GBAAqw1rK4NlRUCUBLhEFUQasjP7xfFqlVbE2cRy0Rs4o3KS0JwzQVBwG85xge
REyPOFdGdhBY2P1FNRy0MDr6xr+D2ZOwxs63dG1nnAnWZg7qwoLgpZ4fESPD3PkA
1ZgKJc2zbSQ9fCPxt2W3mdVav66c6fsb7els2W2Iz7gERJSX
-----END CERTIFICATE-----

so ok to close, I guess