X509_GET_DEFAULT_CERT_FILE(3ossl)

💖 X509_GET_DEFAULT_CERT_FILE 💖

okay bestie, so this one lives in the OpenSSL manual, section 3ossl, and it's literally just about where OpenSSL looks for your trusted CA certs by default. four little functions, one big "here's where the vibes live" energy. let's go 🦋

---

✨ NAME ✨

X509_get_default_cert_file, X509_get_default_cert_file_env, X509_get_default_cert_dir, X509_get_default_cert_dir_env — retrieve default locations for trusted CA certificates

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

const char *X509_get_default_cert_file(void);
const char *X509_get_default_cert_dir(void);

const char *X509_get_default_cert_file_env(void);
const char *X509_get_default_cert_dir_env(void);

---

🎀 DESCRIPTION 🎀

ok so picture this: OpenSSL needs to find your trusted CA certificates, and it's got opinions about where they probably are. these four functions are how you ask it what those opinions are. 💅

• X509_get_default_cert_file() — this one hands you the default path to a file stuffed with trusted CA certificates. OpenSSL uses this as the default path whenever someone asks it to load trusted CA certs from a file and doesn't bother naming a path themselves. and if that file actually exists? boom, certs get loaded from it. no cap. 🔥
• X509_get_default_cert_dir() — this one returns a delimiter-separated list of paths to directories that hold trusted CA certificates in the hashed format (iykyk). OpenSSL uses this as its default list of paths when it's asked to load trusted CA certs from a directory and no other path is specified. and here's the cute part: if a directory in that list exists, OpenSSL goes looking for CA certs in it by calculating a filename from a hash of the certificate's subject name. very math, very slay. ✨
• X509_get_default_cert_file_env() — this doesn't give you a path, bestie, it gives you an environment variable name. it's the one you're recommended to set if you wanna use a nondefault value instead of whatever X509_get_default_cert_file() handed you. ⚠️ but listen: the value returned by X509_get_default_cert_file() is not affected by these environment variables. like, at all. you have to go check for this env var yourself, using this function just to grab the correct variable name. and if the env var isn't set? then yeah, use what X509_get_default_cert_file() gave you. periodt.
• X509_get_default_cert_dir_env() — same deal, but for the directory one. it returns the environment variable name that's recommended for specifying a nondefault value instead of whatever X509_get_default_cert_dir() returned. fun lil twist: the value you set in this env var can also be a store URI (but pls see BUGS below, it's giving chaos 😭).

---

💀 BUGS 💀

ok so this is the part where we hold hands. 🫶

by default — like, for example, when X509_STORE_set_default_paths(3) is used — the environment variable name returned by X509_get_default_cert_dir_env() gets interpreted both as a delimiter-separated list of paths and as a store URI. yeah. both. it's ambiguous and honestly kind of a mess.

here's the example so you get it: if you set the value to "file:///etc/certs", that would cause instantiation of the "file" store provided as part of the default provider... but it would also cause an X509_LOOKUP_hash_dir(3) instance to go hunting for certificates in the directory "file" (relative to the current working directory, bestie, the cwd) and in the directory "///etc/certs". two totally different places. one string. iconic in the worst way. 🙈

if you wanna dodge this whole situation, avoid the environment variable mechanism entirely and use other methods to construct X509_LOOKUP instances instead. ✨

---

🌈 RETURN VALUES 🌈

all four of these return pointers to constant strings with static storage duration. so like, they stick around. no need to free them, no need to panic. 🧚

---

🔥 SEE ALSO 🔥

• X509_LOOKUP(3)
• SSL_CTX_set_default_verify_file(3)
• SSL_CTX_set_default_verify_dir(3)
• SSL_CTX_set_default_verify_store(3)
• SSL_CTX_load_verify_file(3)
• SSL_CTX_load_verify_dir(3)
• SSL_CTX_load_verify_store(3)
• SSL_CTX_load_verify_locations(3)

---

👑 COPYRIGHT 👑

Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 💜 this was version 3.5.9, dated 2026-09-29, filed under X509_GET_DEFAULT_CERT_FILE(3ossl) in the OpenSSL manual — go forth and find your certs, main character 🎀✨