Cargo CA Bundles for the Proxy and Package Server
Apply Cargo's cainfo and proxy-cainfo to the correct TLS connection instead of treating every proxy certificate failure as one trust problem.
For an HTTPS proxy and HTTPS package source, Cargo can verify two TLS connections with different CA bundles:
[http]
proxy = "https://proxy.example:8443"
proxy-cainfo = "/path/to/proxy-ca.pem"
cainfo = "/path/to/origin-ca.pem"Replace the endpoint and paths with your approved values. This proxy deliberately has a TLS listener; an ordinary HTTP proxy does not become HTTPS because the package source uses it.
| Failure stage | Trust setting to inspect |
|---|---|
| Proxy TLS, before a destination tunnel exists | http.proxy-cainfo, which falls back to http.cainfo when not set separately. |
| Destination certificate after tunnel establishment | http.cainfo for the destination trust path. |
The corresponding variables are CARGO_HTTP_PROXY_CAINFO and CARGO_HTTP_CAINFO. Use the appropriate approved authority; copying a random certificate into both files cannot identify which connection is wrong.
A cleartext HTTP proxy carrying CONNECT has no proxy-listener TLS certificate to verify. A destination error there is not repaired by inventing a proxy CA file. Also check that a configured path exists inside the actual container or CI job, and account for operating-system/TLS-backend behavior when comparing environments.
Keep verification enabled. It supplies the identity check needed to distinguish the intended service from a transfer that merely proceeds.