Default SSL cert dir

Question

I have added support for loading HTTPS sites using asio following the example in the documentation which means I call ctx.set_default_verify_paths(); to use the systems default paths for finding the certificates.

However with this I am getting: unable to get local issuer certificate and I notice that it's trying to use /usr/local/ssl/certs on my Ubuntu system.

But I don't even have that directory, instead the certificates seem to be in /etc/ssl/certs so if I am pointing the environment variable SSL_CERT_DIR there it works.

My question is how the default is picked up and how to change it, I don't know if my system is wrong or if the wrong directory is picked up from asio/ssl for some other reason.

Answer 1

I found that the path can be configured when building OpenSSL using --prefix or --openssldir.

But to avoid recompiling OpenSSL another search path can be added like so:

ctx.add_verify_path("/etc/ssl/certs");