Do not use system cert pool when connecting to Astra

astra/bundle.go

@@ -26,7 +26,6 @@ import (
 	"io"
 	"io/ioutil"
 	"net/http"
-	"runtime"
 	"time"
 
 	"github.com/datastax/astra-client-go/v2/astra"
@@ -53,10 +52,7 @@ func LoadBundleZip(reader *zip.Reader) (*Bundle, error) {
 		return nil, err
 	}
 
-	rootCAs, err := createCertPool()
-	if err != nil {
-		return nil, err
-	}
+	rootCAs := createCertPool()
 
 	ok := rootCAs.AppendCertsFromPEM(contents["ca.crt"])
 	if !ok {
@@ -200,10 +196,7 @@ func loadBytes(file *zip.File) ([]byte, error) {
 	return ioutil.ReadAll(r)
 }
 
-func createCertPool() (*x509.CertPool, error) {
-	ca, err := x509.SystemCertPool()
-	if err != nil && runtime.GOOS == "windows" {
-		return x509.NewCertPool(), nil
-	}
-	return ca, err
+
+func createCertPool() *x509.CertPool {
+	return x509.NewCertPool()
 }

astra/endpoint_test.go

@@ -233,10 +233,7 @@ func runTestMetaSvcAsync(sniProxyAddr string, contactPoints []string) (*http.Ser
 }
 
 func createServerTLSConfig(dnsName string) (*tls.Config, error) {
-	rootCAs, err := createCertPool()
-	if err != nil {
-		return nil, err
-	}
+	rootCAs := createCertPool()
 
 	if !rootCAs.AppendCertsFromPEM(testCAPEM) {
 		return nil, errors.New("unable to add cert to CA pool")

go.mod

@@ -1,6 +1,6 @@
 module github.com/datastax/cql-proxy
 
-go 1.24.2
+go 1.19
 
 require (
 	github.com/alecthomas/kong v0.2.17

proxy/run_test.go

@@ -461,7 +461,7 @@ func TestRun_ProxyTLS(t *testing.T) {
 		return checkLiveness(httpBindAddr)
 	}))
 
-	rootCAs, err := createCertPool()
+	rootCAs, err := createSystemCertPool()
 	require.NoError(t, err)
 
 	ok := rootCAs.AppendCertsFromPEM(testCAPEM)
@@ -720,7 +720,7 @@ func checkReadiness(t *testing.T, host string) (outage time.Duration, status int
 	return outage, res.StatusCode
 }
 
-func createCertPool() (*x509.CertPool, error) {
+func createSystemCertPool() (*x509.CertPool, error) {
 	ca, err := x509.SystemCertPool()
 	if err != nil && runtime.GOOS == "windows" {
 		return x509.NewCertPool(), nil