X509_GET_DEFAULT_CERT_FILE(3SSL)

💖 NAME 💖

okay so bestie, four functions live on this page and they all do one very specific, very important thing: retrieve default locations for trusted CA certificates. Meet the lineup:

• X509_get_default_cert_file
• X509_get_default_cert_file_env
• X509_get_default_cert_dir
• X509_get_default_cert_dir_env

this whole thing is the X509_GET_DEFAULT_CERT_FILE(3SSL) page, from the OpenSSL girls, and it's giving "where do we even look for CA certs" 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

const char *X509_get_default_cert_file(void);
const char *X509_get_default_cert_dir(void);

const char *X509_get_default_cert_file_env(void);
const char *X509_get_default_cert_dir_env(void);

four lil functions, all returning const char *, all taking void — no arguments, no drama, low maintenance queens 👑

---

✨ DESCRIPTION ✨

X509_get_default_cert_file() returns the default path to a file that holds trusted CA certificates. When OpenSSL gets asked to load trusted CA certificates from a file and literally nobody specified another path, this is the default path it uses. And if that file exists? Boom — CA certificates are loaded from the file. slay ✨

X509_get_default_cert_dir() returns a default delimiter-separated list of paths to directories containing trusted CA certificates named in the hashed format. Same energy: when OpenSSL is asked to load trusted CA certificates from a directory and no other path is specified, this list is the default list of paths it uses. If a given directory in the list exists, OpenSSL attempts to lookup CA certificates in that directory by calculating a filename based on a hash of the certificate's subject name. hashed format girlies, iykyk 🦋

X509_get_default_cert_file_env() returns an environment variable name, and the recommended move is to use it to specify a nondefault value to be used instead of the value returned by X509_get_default_cert_file(). MAJOR caveat incoming: the value returned by X509_get_default_cert_file() is not affected by these environment variables. OpenSSL is not checking it for you, bestie — you must check for this environment variable yourself, using this function to retrieve the correct environment variable name. And if an environment variable is not set, then the value returned by X509_get_default_cert_file() should be used. periodt 💅

X509_get_default_cert_dir_env() returns the environment variable name that's recommended for specifying a nondefault value to be used instead of the value returned by X509_get_default_cert_dir(). Little plot twist: the value specified by this environment variable can also be a store URI — but go read BUGS below first, okay? 😭

---

💀 BUGS 💀

By default — like, for example, when X509_STORE_set_default_paths(3) is used — the environment variable name returned by X509_get_default_cert_dir_env() is interpreted both as a delimiter-separated list of paths and as a store URI. This is ambiguous. Ambiguity is not the vibe 🫠

Watch how cursed it gets, fr fr: specifying a value of "file:///etc/certs" would cause instantiation of the "file" store provided as part of the default provider, but would also cause an X509_LOOKUP_hash_dir(3) instance to look for certificates in the directory "file" (relative to the current working directory) and the directory "///etc/certs". two completely different readings of the same string, no cap 💀

This can be avoided by avoiding use of the environment variable mechanism and using other methods to construct X509_LOOKUP instances. so like… don't do the thing that does the thing 🙈

---

🫶 RETURN VALUES 🫶

These functions return pointers to constant strings with static storage duration.

that's the whole tea — pointers, constant strings, static storage duration. that's it, that's the return 🎀

---

⭐ SEE ALSO ⭐

• X509_LOOKUP(3)
• SSL_CTX_set_default_verify_file(3)
• SSL_CTX_set_default_verify_dir(3)
• SSL_CTX_set_default_verify_store(3)
• SSL_CTX_load_verify_file(3)
• SSL_CTX_load_verify_dir(3)
• SSL_CTX_load_verify_store(3)
• SSL_CTX_load_verify_locations(3)

go read these next, bestie, they're the whole friend group 🌈

---

👑 COPYRIGHT 👑

Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

and that's the page, bb 🫶 written up as version 4.0.3, dated 2026-09-29, filed under X509_GET_DEFAULT_CERT_FILE(3SSL) — catch you on the next manpage, mwah 💜