`rustls_platform_verifier::Verifier::new_with_extra_roots`: Improve error clarity for invalid certificates

[LukeMathWalker]

The error returned by rustls_platform_verifier::Verifier::new_with_extra_roots doesn't specify which of the provided extra roots was invalid:

    pub fn new_with_extra_roots(
        roots: impl IntoIterator<Item = pki_types::CertificateDer<'static>>,
        crypto_provider: Arc<CryptoProvider>,
    ) -> Result<Self, TlsError> {
        let extra_roots = roots
            .into_iter()
            .map(|root| {
                SecCertificate::from_der(&root)
                    .map_err(|_| TlsError::InvalidCertificate(CertificateError::BadEncoding))
            })
            .collect::<Result<Vec<_>, _>>()?;
        Ok(Self {
            extra_roots,
            #[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
            test_only_root_ca_override: None,
            crypto_provider,
        })
    }

Would there be a way (and interest) in at least mentioning the index of the faulty certificate?

[djc]

I think that could make sense. Want to submit a PR?

[LukeMathWalker]

Sure thing! I'll whip something up tomorrow.

[ofek]

Has this been resolved?

[LukeMathWalker]

Not yet!