how to use self-signed tls certificate when connecting to local relay server

[Sherlock-Holo]

I notice iroh-relay support specify custom tls certificate by

[tls]
cert_mode = "Manual"
manual_cert_path = "/path/to/certs/cert.pem"
manual_key_path = "/path/to/certs/cert.key.pem"

however, when we use custom relay RelayMode::Custom, I only can use RelayNode to create a RelayMap, but it doesn't give me any chance to specify a ca certificate, allow me to connect a self-signed iron relay server

without self-signed tls certificate support, it's hard for me to try to learn and figure out if I can use iroh in my project

[Arqu]

Generally you're not supposed to run that without a proper certificate out in the open, but for testing purposes, there is a flag you can set when creating an endpoint to allow for self signed certs.

An example of usage can be seen here https://github.com/n0-computer/iroh/blob/main/iroh/src/discovery.rs#L1110

It requires the test-utils feature to be enabled on the crate though.

[Sherlock-Holo]

ok... I can enable test-utils when testing, but if someone want to use self-signed certificate, which the relay server certificate is signed by his ca certificate, what should we do?

[matheus23]

I don't think this is quite possible yet. We currently use webpki_roots for the root certificate store to connect to the relays.
We've thought about this issue a bit, and have gotten requests for fixing that before. There's some thinking on this at #2901