Use environment variable to set root certs in c++ interop test.

test/cpp/util/create_test_channel.cc

@@ -45,6 +45,8 @@ namespace grpc {
 // override_hostname is provided.
 // When ssl is not enabled, override_hostname is ignored.
 // Set use_prod_root to true to use the SSL root for connecting to google.
+// In this case, The path to the root file must be set via environment variable
+// GRPC_DEFAULT_SSL_ROOTS_FILE_PATH.
 // Otherwise, root for test SSL cert will be used.
 // creds will be used to create a channel when enable_ssl is true.
 // Use examples:
@@ -60,7 +62,7 @@ std::shared_ptr<ChannelInterface> CreateTestChannel(
   ChannelArguments channel_args;
   if (enable_ssl) {
     const char* roots_certs =
-        use_prod_roots ? prod_roots_certs : test_root_cert;
+        use_prod_roots ? "" : test_root_cert;
     SslCredentialsOptions ssl_opts = {roots_certs, "", ""};
 
     std::unique_ptr<Credentials> channel_creds =

tools/dockerfile/grpc_cxx/Dockerfile

@@ -22,5 +22,7 @@ RUN cd /var/local/git/grpc && ls \
   && make interop_server
 
 ADD service_account service_account
+ADD cacerts cacerts
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH /cacerts/roots.pem
 
 CMD ["/var/local/git/grpc/bins/opt/interop_server", "--enable_ssl", "--port=8010"]

tools/gce_setup/shared_startup_funcs.sh

@@ -389,6 +389,7 @@ grpc_dockerfile_install() {
     grpc_docker_sync_service_account $dockerfile_dir/service_account || return 1;
   }
   [[ $image_label == "grpc/cxx" ]] && {
+    grpc_docker_sync_roots_pem $dockerfile_dir/cacerts || return 1;
     grpc_docker_sync_service_account $dockerfile_dir/service_account || return 1;
   }