//go:build with_cloudflared

package cloudflare

import (
	"crypto/x509"
	_ "embed"

	E "github.com/sagernet/sing/common/exceptions"
)

//go:embed cloudflare_ca.pem
var cloudflareRootCAPEM []byte

func cloudflareRootCertPool() (*x509.CertPool, error) {
	pool, err := x509.SystemCertPool()
	if err != nil {
		pool = x509.NewCertPool()
	}
	if !pool.AppendCertsFromPEM(cloudflareRootCAPEM) {
		return nil, E.New("failed to parse embedded Cloudflare root CAs")
	}
	return pool, nil
}