allow empty cert pool

gravitational · Jan 21, 2025 · 0aa15b3 · 0aa15b3
1 parent 0fc5882
commit 0aa15b3
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/client/interfaces.go b/lib/client/interfaces.go
@@ -309,6 +309,10 @@ func (k *KeyRing) clientCertPool(clusters ...string) (*x509.CertPool, error) {
 		return nil, trace.Wrap(err)
 	}
 	pool := x509.NewCertPool()
+	if len(certPoolPEM) == 0 {
+		// It's valid to have no matching CAs and therefore an empty cert pool.
+		return pool, nil
+	}
 	if !pool.AppendCertsFromPEM(certPoolPEM) {
 		return nil, trace.BadParameter("failed to parse TLS CA certificate")
 	}