Adding roots.pem from Mozilla and associated logic.

- The roots.pem file has been generated from
  https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
  using
  https://github.com/agl/extract-nss-root-certs

1 files changed, 6 insertions, 1 deletions

diff --git a/src/core/security/security_context.c b/src/core/security/security_context.c
index 37a312bc81..ec49ab472d 100644
--- a/src/core/security/security_context.c
+++ b/src/core/security/security_context.c
@@ -402,6 +402,7 @@ static grpc_security_context_vtable ssl_server_vtable = {
 static gpr_slice default_pem_root_certs;
 
 static void init_default_pem_root_certs(void) {
+  /* First try to load the roots from the environment. */
   char *default_root_certs_path =
       gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
   if (default_root_certs_path == NULL) {
@@ -410,7 +411,11 @@ static void init_default_pem_root_certs(void) {
     default_pem_root_certs = gpr_load_file(default_root_certs_path, NULL);
     gpr_free(default_root_certs_path);
   }
-  (void) installed_roots_path;
+
+  /* Fall back to installed certs if needed. */
+  if (GPR_SLICE_IS_EMPTY(default_pem_root_certs)) {
+    default_pem_root_certs = gpr_load_file(installed_roots_path, NULL);
+  }
 }
 
 size_t grpc_get_default_ssl_roots(const unsigned char **pem_root_certs) {