mirror of
https://github.com/0xMassi/webclaw.git
synced 2026-07-22 07:11:01 +02:00
17d805fb6d
The primp-patched rustls fork rejects valid certificates with `InvalidMessage(UnknownCertificateExtension)` on the impersonated client, and `InvalidCertificate(UnknownIssuer)` on the plain fallback. This causes ALL HTTPS requests to fail on Windows (native + WSL), Linux, and Docker — only HTTP works. Root cause: the forked rustls at `github.com/deedy5/primp` cannot parse certain certificate extensions that standard rustls handles. The plain fallback clients also use primp::Client (which goes through the same broken fork), so they fail with UnknownIssuer since the cert chain validation rejects the root CA. Fix: add `.danger_accept_invalid_certs(true)` to all 4 plain fallback client builders in `webclaw-fetch/src/client.rs`. These fallback clients only run when the impersonated TLS client has already failed, so relaxing cert validation here is acceptable as a workaround. The proper long-term fix is to update the primp rustls fork to handle modern certificate extensions correctly. Tested: HTTPS now works on example.com, apartments.com, and real apartment property websites that previously returned "fetch error: request failed: error sending request for url". Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| webclaw-cli | ||
| webclaw-core | ||
| webclaw-fetch | ||
| webclaw-llm | ||
| webclaw-mcp | ||
| webclaw-pdf | ||