[GH-ISSUE #2067] No option to select cert root at hickory_server #871

New issue

Open

opened 2026-03-16 00:40:38 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 00:40:38 +03:00

Owner

Originally created by @LuckyTurtleDev on GitHub (Oct 17, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2067

Describe the bug
No option to select cert root at hickory_server. Looks like it was missing to forward the feature flags for hickory-resolver.

To Reproduce
Cargo.toml

trust-dns-proto = {  package = "hickory-proto", version = "0.24", default-features = false }
trust-dns-server = { package = "hickory-server", version = "0.24", default-features = false,  features = ["dnssec-ring", "dns-over-h3" ,"dns-over-rustls", "dns-over-https-rustls", "dns-over-quic"] }

Make a dot request using trust-dns-server(forward config) and it will fail with the following error message:

hickory_proto::xfer::dns_exchange               > stream errored while connecting error=io error: tls error: invalid peer certificate: UnknownIssuer

Expected behavior
Opiton to enable cert root

System:

OS: [Arch]
Architecture: [x86_64]
Version [0.24.0]
rustc version: [rustc 1.73.0 (cc66ad468 2023-10-03)]

Version:
Crate: [hickory-server]
Version: [0.24.0]

Additional context
Current work around:

trust-dns-proto = {  package = "hickory-proto", version = "0.24", default-features = false }
trust-dns-server = { package = "hickory-server", version = "0.24", default-features = false,  features = ["dnssec-ring", "dns-over-h3" ,"dns-over-rustls", "dns-over-https-rustls", "dns-over-quic"] }
hickory-resolver = { version = "0.24.0", default-features = false, features = ["webpki-roots"] }

Originally created by @LuckyTurtleDev on GitHub (Oct 17, 2023). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2067 **Describe the bug** No option to select cert root at hickory_server. Looks like it was missing to forward the feature flags for hickory-resolver. **To Reproduce** Cargo.toml ```toml trust-dns-proto = { package = "hickory-proto", version = "0.24", default-features = false } trust-dns-server = { package = "hickory-server", version = "0.24", default-features = false, features = ["dnssec-ring", "dns-over-h3" ,"dns-over-rustls", "dns-over-https-rustls", "dns-over-quic"] } ``` Make a dot request using trust-dns-server(forward config) and it will fail with the following error message: ``` hickory_proto::xfer::dns_exchange > stream errored while connecting error=io error: tls error: invalid peer certificate: UnknownIssuer ``` **Expected behavior** Opiton to enable cert root **System:** - OS: [Arch] - Architecture: [x86_64] - Version [0.24.0] - rustc version: [rustc 1.73.0 (cc66ad468 2023-10-03)] **Version:** Crate: [hickory-server] Version: [0.24.0] **Additional context** Current work around: ```toml trust-dns-proto = { package = "hickory-proto", version = "0.24", default-features = false } trust-dns-server = { package = "hickory-server", version = "0.24", default-features = false, features = ["dnssec-ring", "dns-over-h3" ,"dns-over-rustls", "dns-over-https-rustls", "dns-over-quic"] } hickory-resolver = { version = "0.24.0", default-features = false, features = ["webpki-roots"] } ```

kerem added the

crate:server

tools

has workaround

feature:dns-over-https

feature:dns-over-quic

feature:dns-over-tls

labels

2026-03-16 00:40:38 +03:00

kerem commented

2026-03-16 00:40:49 +03:00

Author

Owner

@djc commented on GitHub (Oct 17, 2023):

See also #2066. We should probably avoid pulling rustls-native-certs/webpki-roots unless the forwarding authority is explicitly enabled?

@djc commented on GitHub (Oct 17, 2023): See also #2066. We should probably avoid pulling rustls-native-certs/webpki-roots unless the forwarding authority is explicitly enabled?

kerem commented

2026-03-16 00:40:54 +03:00

Author

Owner

@LuckyTurtleDev commented on GitHub (Oct 17, 2023):

See also https://github.com/hickory-dns/hickory-dns/issues/2066.

Not sure if this is the same issue. It should be fined to have no default certs, but it should be possible to enable them.

We should probably avoid pulling rustls-native-certs/webpki-roots unless the forwarding authority is explicitly enabled?

~~I think a rustls-native-certs/webpki-roots feature should only be possible to enable, if the doh, doq, doc or dot feature is enable.~~
Maybe a forwarding authority feature together with rustls-native-certs/webpki-roots would be a good idea.

@LuckyTurtleDev commented on GitHub (Oct 17, 2023): > See also https://github.com/hickory-dns/hickory-dns/issues/2066. Not sure if this is the same issue. It should be fined to have no default certs, but it should be possible to enable them. > We should probably avoid pulling rustls-native-certs/webpki-roots unless the forwarding authority is explicitly enabled? ~~I think a rustls-native-certs/webpki-roots feature should only be possible to enable, if the doh, doq, doc or dot feature is enable.~~ Maybe a forwarding authority feature together with rustls-native-certs/webpki-roots would be a good idea.

kerem referenced this issue

2026-03-16 02:23:51 +03:00

[PR #871] [CLOSED] Bump tokio-rustls from 0.10.0 to 0.10.1 #1757