Merge pull request #21090 from nextcloud/bug/noid/do-not-read-cert-from-datadir-by-default

Do not read certificate bundle from data dir by default

lib/private/Http/Client/Client.php

@@ -97,20 +97,20 @@ class Client implements IClient {
 	}
 
 	private function getCertBundle(): string {
-		if ($this->certificateManager->listCertificates() !== []) {
-			return $this->certificateManager->getAbsoluteBundlePath();
-		}
-
 		// If the instance is not yet setup we need to use the static path as
 		// $this->certificateManager->getAbsoluteBundlePath() tries to instantiiate
 		// a view
-		if ($this->config->getSystemValue('installed', false)) {
-			return $this->certificateManager->getAbsoluteBundlePath(null);
+		if ($this->config->getSystemValue('installed', false) === false) {
+			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
 		}
 
+		if ($this->certificateManager->listCertificates() === []) {
 			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
 		}
 
+		return $this->certificateManager->getAbsoluteBundlePath();
+	}
+
 	/**
 	 * Returns a null or an associative array specifiying the proxy URI for
 	 * 'http' and 'https' schemes, in addition to a 'no' key value pair

tests/lib/Http/Client/ClientTest.php

@@ -461,9 +461,8 @@ class ClientTest extends \Test\TestCase {
 			->with('installed', false)
 			->willReturn(false);
 		$this->certificateManager
-			->expects($this->once())
-			->method('listCertificates')
-			->willReturn([]);
+			->expects($this->never())
+			->method('listCertificates');
 
 		$this->assertEquals([
 			'verify' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',