From 225be8ec381a77ca44d2e6ca94e629805024e22a Mon Sep 17 00:00:00 2001
From: dovholuknf <46322585+dovholuknf@users.noreply.github.com>
Date: Fri, 10 Feb 2023 17:19:23 -0500
Subject: [PATCH] trust system pool of CAs if cacert is empty

---
 ziti/util/identities.go | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/ziti/util/identities.go b/ziti/util/identities.go
index ad16ce622..6a490aae0 100644
--- a/ziti/util/identities.go
+++ b/ziti/util/identities.go
@@ -81,12 +81,16 @@ func (self *RestClientEdgeIdentity) IsReadOnly() bool {
 func (self *RestClientEdgeIdentity) NewTlsClientConfig() (*tls.Config, error) {
 	rootCaPool := x509.NewCertPool()
 
-	rootPemData, err := os.ReadFile(self.CaCert)
-	if err != nil {
-		return nil, errors.Errorf("could not read session certificates [%s]: %v", self.CaCert, err)
-	}
+	if self.CaCert != "" {
+		rootPemData, err := os.ReadFile(self.CaCert)
+		if err != nil {
+			return nil, errors.Errorf("could not read session certificates [%s]: %v", self.CaCert, err)
+		}
 
-	rootCaPool.AppendCertsFromPEM(rootPemData)
+		rootCaPool.AppendCertsFromPEM(rootPemData)
+	} else {
+		rootCaPool, _ = x509.SystemCertPool()
+	}
 
 	return &tls.Config{
 		RootCAs: rootCaPool,