Merge branch 'fix/emudhra-ca-trust' (#77) into release/2.11

lib/pleroma/http/tls.ex

@@ -15,16 +15,21 @@ defmodule Pleroma.HTTP.TLS do
 
   @spec ssl_options(keyword()) :: keyword()
   def ssl_options(overrides \\ []) do
-    Keyword.merge(
-      [
-        verify: :verify_peer,
-        cacertfile: CAStore.file_path(),
-        depth: 20,
-        customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)],
-        partial_chain: &__MODULE__.reject_partial_chain/1
-      ],
-      overrides
-    )
+    defaults = [
+      verify: :verify_peer,
+      cacertfile: CAStore.file_path(),
+      depth: 20,
+      customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)],
+      partial_chain: &__MODULE__.reject_partial_chain/1
+    ]
+
+    # Hackney drops cacerts when cacertfile is set too.
+    defaults =
+      if Keyword.has_key?(overrides, :cacerts),
+        do: Keyword.delete(defaults, :cacertfile),
+        else: defaults
+
+    Keyword.merge(defaults, overrides)
   end
 
   @doc false
@@ -32,10 +37,13 @@ defmodule Pleroma.HTTP.TLS do
 
   @spec put_hackney_ssl_options(keyword()) :: keyword()
   def put_hackney_ssl_options(opts) do
+    # Hackney 4 ignores the top-level insecure option and falls back to certifi.
     if opts[:insecure] do
-      opts
+      Keyword.put(opts, :ssl_options, verify: :verify_none)
     else
-      Keyword.put(opts, :ssl_options, ssl_options(Keyword.get(opts, :ssl_options, [])))
+      opts
+      |> Keyword.put(:ssl_options, ssl_options(Keyword.get(opts, :ssl_options, [])))
+      |> Keyword.put(:proxy_ssl_options, ssl_options(Keyword.get(opts, :proxy_ssl_options, [])))
     end
   end
 end