android: plumb ExtraRootCAs into wgengine so DERP trusts user/system CA - #842
Open
aefuimn wants to merge 1 commit into
Open
android: plumb ExtraRootCAs into wgengine so DERP trusts user/system CA#842aefuimn wants to merge 1 commit into
aefuimn wants to merge 1 commit into
Conversation
aefuimn
force-pushed
the
release-branch/1.102
branch
from
August 22, 2026 05:44
a29c19f to
5edaf49
Compare
Member
|
Please sent the sys.ExtraRootCAs change separately, with DCO. As for the LazyColumn crash, is this just a dup of #840? But see my comment at #840 (comment) |
bradfitz
requested changes
Aug 22, 2026
bradfitz
left a comment
bradfitz
left a comment
Member
There was a problem hiding this comment.
Please sent the sys.ExtraRootCAs change separately, with DCO.
As for the LazyColumn crash, is this just a dup of #840? But see my comment at #840 (comment)
aefuimn
force-pushed
the
release-branch/1.102
branch
from
August 23, 2026 05:00
5edaf49 to
0551be0
Compare
bradfitz
changed the title
Member
|
This should be fixed on |
App.getUserCACertsPEM() feeds user-installed CAs into tsd.System.ExtraRootCAs, which ipnlocal passes to the control client. That pool was not forwarded to wgengine.Config, so magicsock fell back to the system root pool for DERP connections and rejected a self-signed CA (e.g. for a self-hosted headscale control server) with "x509: certificate signed by unknown authority". Pass sys.ExtraRootCAs through to wgengine.Config (userspace -> magicsock) so DERP TLS trusts the same pool as the control client. Updates #20961 Signed-off-by: aefuimn <33046665+aefuimn@users.noreply.github.com>
aefuimn
force-pushed
the
release-branch/1.102
branch
from
August 23, 2026 05:38
0551be0 to
0a3f05d
Compare
Author
I've changed the target branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Allows the Go engine (libtailscale) to trust a custom self-signed CA for DERP relay connections when it is provided as a user-installed CA (or via
App.getUserCACertsPEM()).The Android app already trusts such a CA for the control client (
tsd.System.ExtraRootCAsis passed toipnlocal). However that pool was not forwarded towgengine.Config, somagicsockfell back to the system root pool for DERP connections and rejected the CA:This left the health warnings
tls-connection-failedandno-derp-connectioneven though the control plane itself connected fine.Change
libtailscale/backend.goExtraRootCAs: sys.ExtraRootCAsintowgengine.Configso DERP TLS uses the same trust pool as the control client (userspace.go->magicsock).Notes for reviewers
App.getUserCACertsPEM()returns user-installed CA certs (AndroidCAStore accounts with auser:prefix). When the CA is installed this way,sys.ExtraRootCAsis non-nil and this change makes DERP trust it. When the CA is instead installed at the system level,getUserCACertsPEM()returns empty /ExtraRootCAsstays nil, and DERP relies on the engine's nativeSystemCertPool()— this change is then a no-op.release-branch/1.102(HEADaea8f60).Testing / verification
libtailscale.aar+ debug APK successfully.no-derp-connection/tls-connection-failedclear and DERP (derp-999, CN) connects.Updates #20961