Add support for SSL_CERT_FILE and SSL_CERT_DIR

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+### Added
+
+- Support for `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables for
+  custom CA store.
+
 ## [0.9] - 2026-07-18
 
 [0.9]: https://github.com/ccache/ccache-storage-http-cpp/releases/tag/v0.9

README.md

@@ -130,6 +130,14 @@ export CCACHE_REMOTE_STORAGE="https://cache.example.com @use-netrc"
 export CCACHE_REMOTE_STORAGE="https://cache.example.com @netrc-file=/path/to/my-netrc"
 ```
 
+### Custom CA store
+
+Set `SSL_CERT_FILE` to a CA certificate bundle or `SSL_CERT_DIR` to a CA
+certificate directory to override the CA store used for HTTPS requests.
+
+Note: The helper process is spawned by ccache, so these variables must be set
+before ccache is invoked.
+
 ## Optional debug logging
 
 You can set the `CRSH_LOGFILE` environment variable to enable debug logging to a

src/config.cpp

@@ -69,6 +69,16 @@ std::optional<Config> parse_config()
   config.idle_timeout_seconds = *idle_val;
   LOG("Idle timeout: " + std::to_string(config.idle_timeout_seconds));
 
+  const char* ssl_cert_file = std::getenv("SSL_CERT_FILE");
+  if (ssl_cert_file && ssl_cert_file[0] != '\0') {
+    config.ssl_cert_file = ssl_cert_file;
+  }
+
+  const char* ssl_cert_dir = std::getenv("SSL_CERT_DIR");
+  if (ssl_cert_dir && ssl_cert_dir[0] != '\0') {
+    config.ssl_cert_dir = ssl_cert_dir;
+  }
+
   const char* num_attr_str = std::getenv("CRSH_NUM_ATTR");
   if (!num_attr_str || num_attr_str[0] == '\0') {
     num_attr_str = "0";

src/config.hpp

@@ -28,6 +28,10 @@ struct Config
   std::vector<std::pair<std::string, std::string>> headers;
   bool use_netrc = false;
   std::optional<std::string> netrc_file;
+
+  // TLS certificate store overrides from the environment.
+  std::optional<std::string> ssl_cert_file;
+  std::optional<std::string> ssl_cert_dir;
 };
 
 std::optional<Config> parse_config();

src/storage_client.cpp

@@ -280,6 +280,14 @@ CURL* StorageClient::create_easy_handle(HttpRequest* request)
   curl_easy_setopt(handle, CURLOPT_WRITEDATA, request);
   curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_callback);
 
+  if (_config.ssl_cert_file) {
+    curl_easy_setopt(handle, CURLOPT_CAINFO, _config.ssl_cert_file->c_str());
+  }
+
+  if (_config.ssl_cert_dir) {
+    curl_easy_setopt(handle, CURLOPT_CAPATH, _config.ssl_cert_dir->c_str());
+  }
+
   if (_config.use_netrc) {
     curl_easy_setopt(handle, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
     if (_config.netrc_file) {