feat: http tls support v3 (#5554)

src/common/infra/cluster/mod.rs

@@ -182,8 +182,12 @@ pub async fn register_and_keep_alive() -> Result<()> {
 
     // check node heatbeat
     tokio::task::spawn(async move {
+        let cfg = get_config();
+        let client = reqwest::ClientBuilder::new()
+            .danger_accept_invalid_certs(true)
+            .build()
+            .unwrap();
         let ttl_keep_alive = min(10, (cfg.limit.node_heartbeat_ttl / 2) as u64);
-        let client = reqwest::Client::new();
         loop {
             tokio::time::sleep(tokio::time::Duration::from_secs(ttl_keep_alive)).await;
             if let Err(e) = check_nodes_status(&client).await {

src/config/src/config.rs

@@ -473,7 +473,7 @@ pub struct Http {
     pub tls_min_version: String,
     #[env_config(
         name = "ZO_HTTP_TLS_ROOT_CERTIFICATES",
-        default = "native",
+        default = "webpki",
         help = "this value must use webpki or native. it means use standard root certificates from webpki-roots or native-roots as a rustls certificate store"
     )]
     pub tls_root_certificates: String,

src/main.rs

@@ -542,8 +542,14 @@ async fn init_http_server() -> Result<(), anyhow::Error> {
         if cfg.common.feature_per_thread_lock {
             thread_id.fetch_add(1, Ordering::SeqCst);
         }
+        let scheme = if cfg.http.tls_enabled {
+            "HTTPS"
+        } else {
+            "HTTP"
+        };
         log::info!(
-            "starting HTTP server at: {}, thread_id: {}",
+            "Starting {} server at: {}, thread_id: {}",
+            scheme,
             haddr,
             local_id
         );
@@ -641,11 +647,19 @@ async fn init_http_server_without_tracing() -> Result<(), anyhow::Error> {
         if cfg.common.feature_per_thread_lock {
             thread_id.fetch_add(1, Ordering::SeqCst);
         }
+
+        let scheme = if cfg.http.tls_enabled {
+            "HTTPS"
+        } else {
+            "HTTP"
+        };
         log::info!(
-            "starting HTTP server at: {}, thread_id: {}",
+            "Starting {} server at: {}, thread_id: {}",
+            scheme,
             haddr,
             local_id
         );
+
         let mut app = App::new().wrap(prometheus.clone());
         if config::cluster::LOCAL_NODE.is_router() {
             let client = awc::Client::builder()

src/service/tls/mod.rs

@@ -59,10 +59,22 @@ pub fn http_tls_config() -> Result<ServerConfig, anyhow::Error> {
 
 pub fn awc_client_tls_config() -> Result<Arc<ClientConfig>, anyhow::Error> {
     let cfg = config::get_config();
-    let cert_store = match cfg.http.tls_root_certificates.as_str() {
-        "webpki" => webpki_roots_cert_store(),
-        "native" => native_roots_cert_store()?,
-        _ => webpki_roots_cert_store(),
+    let cert_store = if cfg.http.tls_root_certificates.as_str().to_lowercase() == "native" {
+        native_roots_cert_store()?
+    } else {
+        // default use webpki, and add custom ca certificates
+        let mut cert_store = webpki_roots_cert_store();
+        let cert_file =
+            &mut BufReader::new(std::fs::File::open(&cfg.http.tls_cert_path).map_err(|e| {
+                anyhow::anyhow!(
+                    "Failed to open TLS certificate file {}: {}",
+                    &cfg.http.tls_cert_path,
+                    e
+                )
+            })?);
+        let cert_chain = certs(cert_file);
+        cert_store.add_parsable_certificates(cert_chain.try_collect::<_, Vec<_>, _>()?);
+        cert_store
     };
 
     let mut config = ClientConfig::builder()