@@ -190,7 +190,7 @@ func makeTestCertFile(t *testing.T, pem, dir string) *os.File {
190190}
191191
192192func TestGetCertPool_NoRoots(t *testing.T) {
193− _, err := GetCertPool([]string(nil))
193+ _, err := GetCertPool([]string(nil), false)
194194 assert.Error(t, err, "invalid empty list of Root CAs file paths")
195195}
196196
@@ -204,34 +204,52 @@ func TestGetCertPool(t *testing.T) {
204204 }
205205 }(tempDir)
206206
207+ rootPool, _ := x509.SystemCertPool()
208+ cleanPool := x509.NewCertPool()
209+
210+ tests := []struct {
211+ appendCerts bool
212+ pool *x509.CertPool
213+ }{
214+ {false, cleanPool},
215+ {true, rootPool},
216+ }
217+
207218 certFile1 := makeTestCertFile(t, root1Cert, tempDir)
208219 certFile2 := makeTestCertFile(t, root2Cert, tempDir)
209220
210− certPool, err := GetCertPool([]string{certFile1.Name(), certFile2.Name()})
211− assert.NoError(t, err)
221+ for _, tc := range tests {
222+ // Append certs to "known" pool so we can compare them
223+ assert.True(t, tc.pool.AppendCertsFromPEM([]byte(root1Cert)))
224+ assert.True(t, tc.pool.AppendCertsFromPEM([]byte(root2Cert)))
212225
213− cert1Block, _ := pem.Decode([]byte(cert1Cert))
214− cert1, _ := x509.ParseCertificate(cert1Block.Bytes)
215− assert.Equal(t, cert1.Subject.String(), cert1CertSubj)
226+ certPool, err := GetCertPool([]string{certFile1.Name(), certFile2.Name()}, tc.appendCerts)
227+ assert.NoError(t, err)
228+ assert.True(t, tc.pool.Equal(certPool))
216229
217− cert2Block, _ := pem.Decode([]byte(cert2Cert))
218− cert2, _ := x509.ParseCertificate(cert2Block.Bytes)
219− assert.Equal(t, cert2.Subject.String(), cert2CertSubj)
230+ cert1Block, _ := pem.Decode([]byte(cert1Cert))
231+ cert1, _ := x509.ParseCertificate(cert1Block.Bytes)
232+ assert.Equal(t, cert1.Subject.String(), cert1CertSubj)
220233
221− cert3Block, _ := pem.Decode([]byte(cert3Cert))
222− cert3, _ := x509.ParseCertificate(cert3Block.Bytes)
223− assert.Equal(t, cert3.Subject.String(), cert3CertSubj)
234+ cert2Block, _ := pem.Decode([]byte(cert2Cert))
235+ cert2, _ := x509.ParseCertificate(cert2Block.Bytes)
236+ assert.Equal(t, cert2.Subject.String(), cert2CertSubj)
224237
225− opts := x509.VerifyOptions{
226− Roots: certPool,
227− }
238+ cert3Block, _ := pem.Decode([]byte(cert3Cert))
239+ cert3, _ := x509.ParseCertificate(cert3Block.Bytes)
240+ assert.Equal(t, cert3.Subject.String(), cert3CertSubj)
241+
242+ opts := x509.VerifyOptions{
243+ Roots: certPool,
244+ }
228245
229− // "cert1" and "cert2" should be valid because "root1" and "root2" are in the certPool
230− // "cert3" should not be valid because "root3" is not in the certPool
231− _, err1 := cert1.Verify(opts)
232− assert.NoError(t, err1)
233− _, err2 := cert2.Verify(opts)
234− assert.NoError(t, err2)
235− _, err3 := cert3.Verify(opts)
236− assert.Error(t, err3)
246+ // "cert1" and "cert2" should be valid because "root1" and "root2" are in the certPool
247+ // "cert3" should not be valid because "root3" is not in the certPool
248+ _, err1 := cert1.Verify(opts)
249+ assert.NoError(t, err1)
250+ _, err2 := cert2.Verify(opts)
251+ assert.NoError(t, err2)
252+ _, err3 := cert3.Verify(opts)
253+ assert.Error(t, err3)
254+ }
237255}