use /etc/pki/ca-trust/source/anchors as cert_dir on modern RHEL?

[aaronenberg]

I noticed that cert_dir always gets certs joined onto it. However, /etc/pki/ca-trust/extracted is a dynamically created directory generated by the update-ca-trust script and the pem subdirectory is just one of the many created by this script that stores PEM bundles. None of them have a certs subdirectory AFAIA.

I think the probe will find the legacy /etc/pki/tls/certs right after and sets cert_dir to that.

Can this directory and possibly others like it be separated from the directories that do have a certs subdirectory?

[aaronenberg]

To add onto this, the appropriate cert_dir replacement on these modern RHEL systems I believe is
/etc/pki/ca-trust/source/anchors for "simple trust anchors". This would be yet another list of cert_dirs that do not have a certs subdirectory but unlike /etc/pki/ca-trust/extracted it is an actual cert_dir

[michael-o]

The only reasonable approach is to point to the dir/file the script is generating and not any source which is being used. This will always result in an incomplete truststore.

[djc]

Hi, the rustls team recently took over maintenance of this crate and I'm working on changes to the probing algorithm in #41. This should address some of the suggestions in the OP but it does not yet /etc/pki/ca-trust/source/anchors. Do you have some kind of reference documentation for this?