ERR_INVALID_HTTP_RESPONSE about rustls

[ctz]

mkcert also does all this logic, which covers Firefox and Chrome-on-Linux: https://github.com/FiloSottile/mkcert/blob/master/truststore_nss.go

[ctz]

Hopefully it's clear that none of the repro steps here include configuring your OS and/or browser to trust .tls/ca_cert.pem as a CA. The details of doing that are quite OS- and browser-specific.

[Ludea]

I updated my issue with step to add created cert into system store

[ctz]

I don't think Chrome relies on the ca-certificates package; it maintains its own store. See, eg, https://portswigger.net/burp/documentation/desktop/external-browser-config/certificate/ca-cert-chrome-linux

[Ludea]

:(
I guess it's the same thing for edge / Firefox / safari ?

[ctz]

It differs between browsers and platforms. The value of tools like mkcert is automating it across browsers and platforms.

$ sudo apt-get install mkcert libnss3-tools
(...)
$ mkdir mkcert
$ cd mkcert/
$ mkcert -install
Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)! 🦊

$ mkcert localhost

Created a new certificate valid for the following names 📜
 - "localhost"

The certificate is at "./localhost.pem" and the key at "./localhost-key.pem" ✅

It will expire on 13 March 2026 🗓

$ cd ~/rustls
$ cargo run -p rustls-examples --bin tlsserver-mio -- --certs ~/mkcert/localhost.pem --key ~/mkcert/localhost-key.pem --port 8443 http

( https://localhost:8443 now works locally in google chrome, curl, etc.)

[Ludea]

I do same step as mkcert : https://github.com/FiloSottile/mkcert/blob/master/truststore_linux.go#L70. So I expect the same thing as you got with my created cert.
Maybe I miss something ?

[cpu]

copy .tls/ca_cert.pem to /usr/local/share/ca-certificates/ca_cert.crt
run sudo update-ca-certificates
...
I do same step as mkcert

That file-path is not the only path mkcert looks at: https://github.com/FiloSottile/mkcert/blob/2a46726cebac0ff4e1f133d90b4e4c42f1edf44a/truststore_linux.go#L36-L48

Have you tried using the upstream mkcert like Ctz described? Did it work?

If mkcert works and your version doesn't it would indicate you're missing some logic that mkcert handles.

[Ludea]

mkcert also does all this logic, which covers Firefox and Chrome-on-Linux: https://github.com/FiloSottile/mkcert/blob/master/truststore_nss.go

I missed that, Thanks for sharing this. I did not know about NSS