Setting of SSL_CERT_FILE in newer images causes issues with PInvoke C extensions

[cretz]

Describe the bug

As part of #1661, the AWS .NET 8 image, SSL_CERT_FILE env var is forcefully set to a no-op because it was assumed only the .NET code/runtime would use such a file. However, some .NET apps have C/Pinvoke extensions that do not expect this to be set to an empty file.

In our case (https://github.com/temporalio/sdk-dotnet), we have a Rust extension that uses https://github.com/hyperium/tonic which uses https://github.com/rustls/rustls-native-certs which uses https://github.com/alexcrichton/openssl-probe. When this was set to /tmp/noop in #1661 this didn't get used because the file didn't exist, but once it became a real file in #1663, now every Rust library using TLS this way (most I assume) does not have a CA cert bundle and therefore fails to validate server certs during TLS connections. And really any TLS library properly respecting SSL_CERT_FILE will have this problem.

Is there any way to solve whatever was trying to be solved in #1661 without setting an override variable that affects all TLS libraries?

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Expect .NET extensions to be able to communicate over TLS same as if they were running on any other normal image. And expect OpenSSL environment variable overrides to not be present so default behavior still occurs. This was the case I believe in the .NET 6 runtime.

Current Behavior

Libraries that (properly) support SSL_CERT_FILE env var overrides now fail where they used to succeed (e.g. I believe in the .NET 6 runtime).

Reproduction Steps

I admit I have not built a standalone replication though I can if I must (though it takes a while to setup an entire project with Rust PInvoke extension). Here's an admittedly unfair/obvious reproduction:

if (Environment.GetEnvironmentVariable("SSL_CERT_FILE") != null)
{
    throw new InvalidOperationException("SSL cert file default overridden implicitly");
}

Possible Solution

No response

Additional Information/Context

No response

AWS .NET SDK and/or Package version used

Amazon.Lambda.Core 2.5.0 (default with code template)

Targeted .NET Platform

.NET 8

Operating System and version

AmazonLinux 2023