add --ca-cert option

README.md

@@ -187,6 +187,8 @@ GLOBAL OPTIONS:
    --upload-size value            Size of payload being uploaded in KiB (default: 1024)
    --secure                       Use HTTPS instead of HTTP when communicating with
                                   LibreSpeed.org operated servers (default: false)
+   --ca-cert value                Use the specified CA certificate PEM bundle file instead
+                                  of the system certificate trust store
    --skip-cert-verify             Skip verifying SSL certificate for HTTPS connections (self-signed certs) (default: false)
    --no-pre-allocate              Do not pre allocate upload data. Pre allocation is
                                   enabled by default to improve upload performance. To

defs/options.go

@@ -29,6 +29,7 @@ const (
 	OptionUploadSize      = "upload-size"
 	OptionDuration        = "duration"
 	OptionSecure          = "secure"
+	OptionCACert          = "ca-cert"
 	OptionSkipCertVerify  = "skip-cert-verify"
 	OptionNoPreAllocate   = "no-pre-allocate"
 	OptionVersion         = "version"

main.go

@@ -164,6 +164,11 @@ func main() {
 				Usage: "Use HTTPS instead of HTTP when communicating with\n" +
 					"\tLibreSpeed.org operated servers",
 			},
+			&cli.StringFlag{
+				Name: defs.OptionCACert,
+				Usage: "Use the specified CA certificate PEM bundle file instead\n" +
+				    "\tof the system certificate trust store",
+			},
 			&cli.BoolFlag{
 				Name:  defs.OptionSkipCertVerify,
 				Usage: "Skip verifying SSL certificate for HTTPS connections (self-signed certs)",

speedtest/speedtest.go

@@ -3,6 +3,7 @@ package speedtest
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -154,8 +155,25 @@ func SpeedTest(c *cli.Context) error {
 		network = "ip"
 	}
 
-	transport := http.DefaultTransport.(*http.Transport).Clone()
-	transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: c.Bool(defs.OptionSkipCertVerify)}
+    transport := http.DefaultTransport.(*http.Transport).Clone()
+
+    if caCertFileName := c.String(defs.OptionCACert); caCertFileName != "" {
+        caCert, err := ioutil.ReadFile(caCertFileName)
+        if err != nil {
+            log.Fatal(err)
+        }
+        caCertPool := x509.NewCertPool()
+        caCertPool.AppendCertsFromPEM(caCert)
+
+        transport.TLSClientConfig = &tls.Config{
+            InsecureSkipVerify: c.Bool(defs.OptionSkipCertVerify),
+            RootCAs: caCertPool,
+        }
+    } else {
+        transport.TLSClientConfig = &tls.Config{
+            InsecureSkipVerify: c.Bool(defs.OptionSkipCertVerify),
+        }
+    }
 
 	// bind to source IP address if given, or if ipv4/ipv6 is forced
 	if src := c.String(defs.OptionSource); src != "" || (forceIPv4 || forceIPv6) {