Enable root cert providers through feature flags

Cargo.toml

@@ -19,7 +19,9 @@ all-features = true
 default = []
 native-tls = ["native-tls-crate"]
 native-tls-vendored = ["native-tls", "native-tls-crate/vendored"]
-rustls-tls = ["rustls", "webpki", "rustls-native-certs"]
+rustls-tls = ["rustls", "webpki"]
+rustls-tls-native-roots = ["rustls-tls", "rustls-native-certs"]
+rustls-tls-webpki-roots = ["rustls-tls", "webpki-roots"]
 
 [dependencies]
 base64 = "0.13.0"
@@ -43,13 +45,17 @@ version = "0.2.3"
 optional = true
 version = "0.19.0"
 
+[dependencies.rustls-native-certs]
+optional = true
+version = "0.5.0"
+
 [dependencies.webpki]
 optional = true
 version = "0.21"
 
-[dependencies.rustls-native-certs]
+[dependencies.webpki-roots]
 optional = true
-version = "0.5.0"
+version = "0.21"
 
 [dev-dependencies]
 criterion = "0.3.4"

src/client.rs

@@ -71,12 +71,21 @@ mod encryption {
             Mode::Plain => Ok(StreamSwitcher::Plain(stream)),
             Mode::Tls => {
                 let config = {
+                    #[allow(unused_mut)]
                     let mut config = ClientConfig::new();
-                    config.root_store =
+                    #[cfg(feature = "rustls-native-roots")]
-                        rustls_native_certs::load_native_certs().map_err(|(_, err)| err)?;
+                    {
+                        config.root_store =
+                            rustls_native_certs::load_native_certs().map_err(|(_, err)| err)?;
+                    }
+                    #[cfg(feature = "rustls-webpki-roots")]
+                    {
+                        config.root_store.add_server_trust_anchors(&webpki_roots::TLS_SERVER_ROOTS);
+                    }
 
                     Arc::new(config)
                 };
+
                 let domain = DNSNameRef::try_from_ascii_str(domain).map_err(TlsError::Dns)?;
                 let client = ClientSession::new(&config, domain);
                 let stream = StreamOwned::new(client, stream);