From f5dbc27a01f5068e30403333a44c9ac8c9418dc8 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Wed, 22 Apr 2026 09:36:45 +0200
Subject: [PATCH] global-functions: $CertificateDownload: extend the check for
 builtin certificates

---
 global-functions.rsc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index de991817..81f49f7d 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -191,7 +191,12 @@
     $LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . \
       "' from repository! Trying fallback to mkcert.org...");
     :do {
-      :if ([ :len [ /certificate/find where common-name="ISRG Root X1" ] ] = 0) do={
+      :local CertSettings [ /certificate/settings/get ];
+      :if ([ :len [ /certificate/find where common-name="ISRG Root X1" ] ] = 0 && \
+           !((($CertSettings->"builtin-trust-anchors") = "trusted" || \
+              ($CertSettings->"builtin-trust-store") ~ "fetch" || \
+              ($CertSettings->"builtin-trust-store") = "all") && \
+             [ :len [ /certificate/builtin/find where common-name="ISRG Root X1" ] ] > 0)) do={
         $LogPrint error $0 ("Required certificate is not available.");
         :return false;
       }