How to find out the path for OpenSSL trusted certificates?

Question

How can I find out where my OpenSSL installation is looking for installed (trusted) certificates?

It is sometimes /etc/ssl/cert, but I have a new system and it is not working with this path.

Midis

Try finding your system type on this page: gagravarr.org/writing/openssl-certs/others.shtml – Moritz

Answer 1

This C snippet, compiled against OpenSSL, will tell you:

#include <stdlib.h>
#include <stdio.h>
#include <openssl/x509.h>

int main()
{
    const char *dir;

    dir = getenv(X509_get_default_cert_dir_env());

    if (!dir)
        dir = X509_get_default_cert_dir();

    puts(dir);

    return 0;
}

Ala

gcc -o cafscode cafscode.c $(pkg-config --libs --cflags openssl) – Mexico

It took a while to make a choice - on who to upvote. In the literal sense, this code best answers the question - which directory are the certificates in. At least on my system openssl version -d gives the directory containing the certs directory. And, so I am armed with the confidence of where to look, and where to try and store things - and, following @jww warning - maybe openssl does nothing, by default, with anything put there. – Refectory

Answer 2

The default path where certificates are looked up might be different on each platform. You can lookup your system configuration using the following command:

$ openssl version -d

OPENSSLDIR: "/etc/pki/tls"

Tamarra

Answer 3

The path you are looking for is the "Directory for OpenSSL files". As @tnbt answered, openssl version -d (or -a) gives you the path to this directory. OpenSSL looks here for a file named cert.pem and a subdirectory certs/. Certificates it finds there are treated as trusted by openssl s_client and openssl verify (source: the article, What certificate authorities does OpenSSL recognize?).

% openssl version -d
OPENSSLDIR: "/opt/local/etc/openssl"
% ls -l /opt/local/etc/openssl/cert*
lrwxr-xr-x  1 root  admin  40 29 Nov 02:05 /opt/local/etc/openssl/cert.pem -> /opt/local/share/curl/curl-ca-bundle.crt
% head -10 /opt/local/etc/openssl/cert.pem
##
## Bundle of CA Root Certificates
##
## Certificate data from Mozilla as of: Fri Nov 24 08:00:26 2017 GMT
##
## This is a bundle of X.509 certificates of public Certificate Authorities
## (CA). These were automatically extracted from Mozilla's root certificates
## file (certdata.txt).  This file can be found in the mozilla source tree:
## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
##
...[rest of file omitted]...

It turns out that the installer which installed OpenSSL on my system also installed cert.pem as a symlink to a bundle of Certificate Authority certificates from the tool cUrl . Those in turn came from Mozilla.

You might have nothing installed in this file or directory, or you might have a different set of certificates. This will affect which server certificates OpenSSL verifies.

OpenSSL commands like s_client support, I think since version 1.1, options -no-CAfile and -no-CApath. These let you ignore the certificates in this file and directory respectively, for the duration of one command. (I can't reproduce this because I am still using version 1.0.2, and it lacks those options.)

Backup

Answer 4

How can I find out, where my openssl installed is looking for installed certificates (trusted)?

You can't. OpenSSL trusts nothing by default, and it does not go looking for certs. You have to instruct it what to trust. There's even a FAQ topic covering it: Why does <SSL program> fail with a certificate verify error?:

This problem is usually indicated by log messages saying something like "unable to get local issuer certificate" or "self signed certificate". When a certificate is verified its root CA must be "trusted" by OpenSSL this typically means that the CA certificate must be placed in a directory or file and the relevant program configured to read it. The OpenSSL program 'verify' behaves in a similar way and issues similar error messages: check the verify(1) program manual page for more information.

---

Caf's answer is kind of correct, but OpenSSL does not use it and there's nothing there...

$ grep -R X509_get_default_cert_dir *
...
crypto/x509/x509_def.c:const char *X509_get_default_cert_dir(void)
...

In the above, notice it does not hit on anything in the apps/ directory. apps/ is where all the OpenSSL samples and utilities are, like openssl req, openssl rsa, openssl dsa, openssl x509, openssl sign, openssl verify, etc.

Then:

$ cat crypto/x509/x509_def.c
...
const char *X509_get_default_cert_dir(void)
    { return(X509_CERT_DIR); }
...

$ grep -R X509_CERT_DIR *
crypto/cryptlib.h:#define X509_CERT_DIR     OPENSSLDIR "/certs"

And finally:

$ ls /usr/local/ssl/certs/
$

Like I said, its not used and there's nothing there.

Cookshop

OpenSSL certainly trusts certain certificates automatically: any which are found in the "Directory for OpenSSL files", in either a file named cert.pem or in the subdirectory certs/. Source: What certificate authorities does OpenSSL recognize? . Now, it may be that your installation has nothing in this directory, but my installation has a cert.pem symlinked to a collection of root Certificate Authority certificate, so my installation trusts many sites "automatically". – Backup