4 files changed, 35 insertions, 17 deletions
diff --git a/core/SCsub b/core/SCsub
index 8012ed132c..6746cc871a 100644
--- a/core/SCsub
+++ b/core/SCsub
@@ -94,7 +94,7 @@ if 'builtin_zstd' in env and env['builtin_zstd']:
 env.add_source_files(env.core_sources, "*.cpp")
 
 # Certificates
-env.Depends("#core/io/certs_compressed.gen.h", ["#thirdparty/certs/ca-certificates.crt", env.Value(env['builtin_certs'])])
+env.Depends("#core/io/certs_compressed.gen.h", ["#thirdparty/certs/ca-certificates.crt", env.Value(env['builtin_certs']), env.Value(env['system_certs_path'])])
 env.CommandNoCache("#core/io/certs_compressed.gen.h", "#thirdparty/certs/ca-certificates.crt", run_in_subprocess(core_builders.make_certs_header))
 
 # Make binders
diff --git a/core/core_builders.py b/core/core_builders.py
index 7b2f88a242..f3a9e3b221 100644
--- a/core/core_builders.py
+++ b/core/core_builders.py
@@ -21,6 +21,10 @@ def make_certs_header(target, source, env):
     g.write("/* THIS FILE IS GENERATED DO NOT EDIT */\n")
     g.write("#ifndef _CERTS_RAW_H\n")
     g.write("#define _CERTS_RAW_H\n")
+
+    # System certs path. Editor will use them if defined. (for package maintainers)
+    path = env['system_certs_path']
+    g.write("#define _SYSTEM_CERTS_PATH \"%s\"\n" % str(path))
     if env['builtin_certs']:
         # Defined here and not in env so changing it does not trigger a full rebuild.
         g.write("#define BUILTIN_CERTS_ENABLED\n")
diff --git a/core/io/stream_peer_ssl.cpp b/core/io/stream_peer_ssl.cpp
index a02565bc1c..8d8682686a 100644
--- a/core/io/stream_peer_ssl.cpp
+++ b/core/io/stream_peer_ssl.cpp
@@ -44,13 +44,20 @@ StreamPeerSSL *StreamPeerSSL::create() {
 
 StreamPeerSSL::LoadCertsFromMemory StreamPeerSSL::load_certs_func = NULL;
 bool StreamPeerSSL::available = false;
-bool StreamPeerSSL::initialize_certs = true;
 
 void StreamPeerSSL::load_certs_from_memory(const PoolByteArray &p_memory) {
 	if (load_certs_func)
 		load_certs_func(p_memory);
 }
 
+void StreamPeerSSL::load_certs_from_file(String p_path) {
+	if (p_path != "") {
+		PoolByteArray certs = get_cert_file_as_array(p_path);
+		if (certs.size() > 0)
+			load_certs_func(certs);
+	}
+}
+
 bool StreamPeerSSL::is_available() {
 	return available;
 }
@@ -63,6 +70,25 @@ bool StreamPeerSSL::is_blocking_handshake_enabled() const {
 	return blocking_handshake;
 }
 
+PoolByteArray StreamPeerSSL::get_cert_file_as_array(String p_path) {
+
+	PoolByteArray out;
+	FileAccess *f = FileAccess::open(p_path, FileAccess::READ);
+	if (f) {
+		int flen = f->get_len();
+		out.resize(flen + 1);
+		PoolByteArray::Write w = out.write();
+		f->get_buffer(w.ptr(), flen);
+		w[flen] = 0; // Make sure it ends with string terminator
+		memdelete(f);
+#ifdef DEBUG_ENABLED
+		print_verbose(vformat("Loaded certs from '%s'.", p_path));
+#endif
+	}
+
+	return out;
+}
+
 PoolByteArray StreamPeerSSL::get_project_cert_array() {
 
 	PoolByteArray out;
@@ -71,18 +97,7 @@ PoolByteArray StreamPeerSSL::get_project_cert_array() {
 
 	if (certs_path != "") {
 		// Use certs defined in project settings.
-		FileAccess *f = FileAccess::open(certs_path, FileAccess::READ);
-		if (f) {
-			int flen = f->get_len();
-			out.resize(flen + 1);
-			PoolByteArray::Write w = out.write();
-			f->get_buffer(w.ptr(), flen);
-			w[flen] = 0; // Make sure it ends with string terminator
-			memdelete(f);
-#ifdef DEBUG_ENABLED
-			print_verbose(vformat("Loaded certs from '%s'.", certs_path));
-#endif
-		}
+		return get_cert_file_as_array(certs_path);
 	}
 #ifdef BUILTIN_CERTS_ENABLED
 	else {
diff --git a/core/io/stream_peer_ssl.h b/core/io/stream_peer_ssl.h
index f66c1c7de9..8ce36d7e7d 100644
--- a/core/io/stream_peer_ssl.h
+++ b/core/io/stream_peer_ssl.h
@@ -46,9 +46,6 @@ protected:
 	static LoadCertsFromMemory load_certs_func;
 	static bool available;
 
-	friend class Main;
-	static bool initialize_certs;
-
 	bool blocking_handshake;
 
 public:
@@ -72,7 +69,9 @@ public:
 
 	static StreamPeerSSL *create();
 
+	static PoolByteArray get_cert_file_as_array(String p_path);
 	static PoolByteArray get_project_cert_array();
+	static void load_certs_from_file(String p_path);
 	static void load_certs_from_memory(const PoolByteArray &p_memory);
 	static bool is_available();