Default to empty ca roots for tls connections (#62)

Author: kezhuw

Cargo.toml

@@ -16,7 +16,8 @@ rust-version = "1.76"
 
 [features]
 default = []
-tls = ["rustls", "rustls-pemfile", "webpki-roots", "futures-rustls"]
+tls = ["rustls", "rustls-pemfile", "futures-rustls"]
+tls-mozilla-roots = ["tls", "webpki-roots"]
 sasl = ["sasl-gssapi", "sasl-digest-md5"]
 sasl-digest-md5 = ["rsasl/unstable_custom_mechanism", "md5", "linkme", "hex"]
 sasl-gssapi = ["rsasl/gssapi"]
@@ -39,7 +40,7 @@ either = "1.9.0"
 uuid = { version = "1.4.1", features = ["v4"] }
 rustls = { version =  "0.23.2", optional = true }
 rustls-pemfile = { version = "2", optional = true }
-webpki-roots = { version = "0.26.1", optional = true }
+webpki-roots = { version = "1.0.1", optional = true }
 derive-where = "1.2.7"
 fastrand = "2.0.2"
 tracing = "0.1.40"

src/tls.rs

@@ -28,11 +28,9 @@ impl Clone for TlsOptions {
 }
 
 impl Default for TlsOptions {
-    /// Tls options with well-known ca roots.
+    /// Same as [Self::new].
     fn default() -> Self {
-        let mut options = Self::no_ca();
-        options.ca_certs.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-        options
+        Self::new()
     }
 }
 
@@ -106,12 +104,26 @@ impl ServerCertVerifier for TlsServerCertVerifier {
 }
 
 impl TlsOptions {
-    /// Tls options with no ca certificates. Use [TlsOptions::default] if well-known ca roots is
-    /// desirable.
+    /// Tls options with no ca certificates.
+    #[deprecated(since = "0.10.0", note = "use TlsOptions::new instead")]
     pub fn no_ca() -> Self {
+        Self::new()
+    }
+
+    /// Tls options with no ca certificates.
+    pub fn new() -> Self {
         Self { ca_certs: RootCertStore::empty(), identity: None, hostname_verification: true }
     }
 
+    /// Trusts root certificates trusted by Mozilla.
+    ///
+    /// See [webpki-roots](https://docs.rs/webpki-roots) for more.
+    #[cfg(feature = "tls-mozilla-roots")]
+    pub fn with_mozilla_roots(mut self) -> Self {
+        self.ca_certs.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
+        self
+    }
+
     /// Disables hostname verification in tls handshake.
     ///
     /// # Safety