From 101e1b068a62aeece725362c38f8fe4179b5fe5f Mon Sep 17 00:00:00 2001
From: Timofey Maykov <156189619+timofey-maykov@users.noreply.github.com>
Date: Wed, 23 Sep 2026 15:29:37 +0300
Subject: [PATCH] fix(updater): stop overriding SSL_CERT_FILE and SSL_CERT_DIR
 on Linux (#3615)

check() set both variables to Debian paths when they were unset. On distros
with a different layout, such as ALT Linux, the paths do not exist, and
rustls-native-certs then loads roots only from them, so every TLS client
created afterwards in the app got an empty root store.

reqwest with rustls already finds the system store through
rustls-platform-verifier and openssl-probe, so the override is not needed.

Closes #3598
---
 .changes/updater-remove-ssl-cert-env.md |  6 ++++++
 plugins/updater/src/updater.rs          | 10 ----------
 2 files changed, 6 insertions(+), 10 deletions(-)
 create mode 100644 .changes/updater-remove-ssl-cert-env.md

diff --git a/.changes/updater-remove-ssl-cert-env.md b/.changes/updater-remove-ssl-cert-env.md
new file mode 100644
index 000000000..263f3fbde
--- /dev/null
+++ b/.changes/updater-remove-ssl-cert-env.md
@@ -0,0 +1,6 @@
+---
+"updater": patch:bug
+"updater-js": patch:bug
+---
+
+On Linux, `check()` no longer sets `SSL_CERT_FILE` and `SSL_CERT_DIR` to Debian paths. The override pointed rustls to files that do not exist on distros with a different layout, such as ALT Linux, and left every TLS client in the app without root certificates.
diff --git a/plugins/updater/src/updater.rs b/plugins/updater/src/updater.rs
index d04a19cdb..809cd0065 100644
--- a/plugins/updater/src/updater.rs
+++ b/plugins/updater/src/updater.rs
@@ -539,16 +539,6 @@ impl Updater {
             headers.insert(ACCEPT, HeaderValue::from_static("application/json"));
         }
 
-        // Set SSL certs for linux if they aren't available.
-        #[cfg(target_os = "linux")]
-        {
-            if std::env::var_os("SSL_CERT_FILE").is_none() {
-                std::env::set_var("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt");
-            }
-            if std::env::var_os("SSL_CERT_DIR").is_none() {
-                std::env::set_var("SSL_CERT_DIR", "/etc/ssl/certs");
-            }
-        }
         let target = if let Some(target) = &self.target {
             target
         } else {