Where Do Linux Systems Find Their TLS Root Certificate Authority Certificates?

Where Are Certificates Acquired for TLS Root CAs on Linux?

According to crypto/tls.Config.RootCAs, which defines the set of trusted root certificate authorities (CAs), the host's root CA set is used for verification when RootCAs is nil. Understanding the process of acquiring these certificates enables administrators to trust additional root CAs.

On Linux systems, TLS checks several locations in sequence to obtain the host's root CA set:

• /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu/Gentoo)
• /etc/pki/tls/certs/ca-bundle.crt (Fedora/RHEL 6)
• /etc/ssl/ca-bundle.pem (OpenSUSE)
• /etc/pki/tls/cacert.pem (OpenELEC)
• /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (CentOS/RHEL 7)
• /etc/ssl/cert.pem (Alpine Linux)

If any of these files exist, TLS will use the certificates contained within to build the host's root CA set. This understanding allows for seamless management of trusted CAs by administering these files as needed.

The above is the detailed content of Where Do Linux Systems Find Their TLS Root Certificate Authority Certificates?. For more information, please follow other related articles on the PHP Chinese website!