X509_GET_DEFAULT_CERT_FILE(3ossl)

💖 X509_GET_DEFAULT_CERT_FILE 💖

okay so bestie, this is the 3ossl page — it's all OpenSSL vibes, and it's about four little functions that tell you where OpenSSL thinks your trusted CA certificates live by default. no cap, that's the whole plot. let's get into it 🎀

---

✨ SYNOPSIS ✨

like, here's the whole cast, in code, exactly as written:

#include <openssl/x509.h>

const char *X509_get_default_cert_file(void);
const char *X509_get_default_cert_dir(void);

const char *X509_get_default_cert_file_env(void);
const char *X509_get_default_cert_dir_env(void);

two of them give you paths, two of them give you environment variable names. iconic quartet honestly 🫶

---

🌸 DESCRIPTION 🌸

the file one 📄

X509_get_default_cert_file() hands you the default path to a file that's supposed to contain trusted CA certificates. OpenSSL uses this as the default path whenever somebody asks it to load trusted CA certs from a file and didn't bother specifying a path. and if that file actually exists? boom, CA certificates get loaded from it. slay ✨

the directory one 📁

X509_get_default_cert_dir() returns a delimeter-separated list of paths to directories containing trusted CA certificates named in the hashed format. OpenSSL uses this as the default list of paths when it's asked to load trusted CA certificates from a directory and no other path was given. for each directory in the list, if it exists, OpenSSL tries to look up CA certificates in it by computing a filename based on a hash of the certificate's subject name. it's giving detective work 🔍

the env var ones 🌈

X509_get_default_cert_file_env() returns an environment variable name — and the recommendation is that you use that env var to specify a nondefault value instead of whatever X509_get_default_cert_file() gave you. and here's the crucial part, bestie, do not skip this:

the value returned by X509_get_default_cert_file() is not affected by these environment variables. like, at all. you have to check for the env var yourself, using this function to get the correct env var name. and if that environment variable isn't set? then use the value from X509_get_default_cert_file(). periodt 💅

X509_get_default_cert_dir_env() returns the environment variable name that's recommended for specifying a nondefault value instead of the one from X509_get_default_cert_dir(). and the value you put in that env var can also be a store URI — but pls see BUGS below, because 😭

---

💀 BUGS 💀

okay so this is the messy part, and it's genuinely messy, not cute-messy:

by default — like, for example when X509_STORE_set_default_paths(3) is used — the environment variable name returned by X509_get_default_cert_dir_env() gets interpreted both as a delimiter-separated list of paths and as a store URI. which is, and I cannot stress this enough, ambiguous. 🫠

the example they give: set it to "file:///etc/certs" and you get both of these happening at once —

• an instantiation of the "file" store provided as part of the default provider, and
• an X509_LOOKUP_hash_dir(3) instance looking for certificates in the directory "file" (relative to the current working directory) and in the directory "///etc/certs".

not me getting two completely different meanings from one string 💀

and how do you dodge this? by avoiding the environment variable mechanism entirely and using other methods to construct X509_LOOKUP instances. that's the move. 🙈

---

⭐ RETURN VALUES ⭐

all four of them return pointers to constant strings with static storage duration. so like, don't go freeing them, they're not yours, they live there 👑

---

🦋 SEE ALSO 🦋

go read these next, iykyk:

• X509_LOOKUP(3)
• SSL_CTX_set_default_verify_file(3)
• SSL_CTX_set_default_verify_dir(3)
• SSL_CTX_set_default_verify_store(3)
• SSL_CTX_load_verify_file(3)
• SSL_CTX_load_verify_dir(3)
• SSL_CTX_load_verify_store(3)
• SSL_CTX_load_verify_locations(3)

---

👑 COPYRIGHT 👑

Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page!! mwah 💋 this was OpenSSL 3.5.0, dated 2026-09-25, from the X509_GET_DEFAULT_CERT_FILE(3ossl) manual — go forth and find your certs bestie, you've got this 🧚‍♀️🍓