the cert browser is trusted， but zcrypto Invalid display certificate？

[chushuai]

https://new-proxy.shunwang.com/

the cert browser is trusted， but zcrypto Invalid display certificate

[chushuai]

does not load system default certificate
The zcrypto code
https://github.com/zmap/zcrypto/blob/master/x509/verify.go#L283

    if opts.Roots == nil {
        err = SystemRootsError{}
        return
    }

the golang crypto/tls

if opts.Roots == nil {
        opts.Roots = systemRootsPool()
        if opts.Roots == nil {
            return nil, SystemRootsError{systemRootsErr}
        }
    }

[mzpqnxow]

I believe this is by design, to provide flexibility

If you desire the same behavior as the upstream golang tls, you should set opt.roots = systemRootsPool() when calling that function

[dadrian]

Yes, this is intentional. You must provide your own roots when using ZCrypto.