Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to add a .pem cert file to my default CA cert bundle but I don't know where the default CA Cert bundle is kept.

I need to append my new .pem file to this default bundle. I'd rather do that than specify my own location using --capath

cURL clearly knows where to look but I don't see any cURL commands that reveal the location. Is there a command that will reveal this location? How can I find it?

According to cURL:
Add the CA cert for your server to the existing default CA cert bundle. The default path of the CA bundle used can be changed by running configure with the --with-ca-bundle option pointing out the path of your choice.


share|improve this question
What operating system are you using? – Cristian Ciupitu Mar 7 '13 at 14:40
up vote 2 down vote accepted

Running curl with strace might give you a clue.

strace curl |& grep open

Lots of output, but right near the end I see:

open("/etc/ssl/certs/578d5c04.0", O_RDONLY) = 4

which is where my certificates are stored.

share|improve this answer

There should be a program 'curl-config' in curl's 'bin/', i.e. where the 'curl' binary resides.

./curl-config --ca

gives the ca bundle install path.

I just did a whatis curl-config: "Get information about a libcurl installation" so I guess it will only be available if libcurl was installed, which I presume is standard though.

share|improve this answer

you could download the CA Root Certificates bundle from who are the creators of curl. then just append your certificate in their .pem and refer to it when using curl with the --cacert option

share|improve this answer

The default CA bundle location is OS dependent. On RHEL5, it is located in /etc/pki/tls/certs/ca-bundle.pem. On other flavors of Linux or non-linux OSes, it may be in a different location.

share|improve this answer
So I guess I just search for that file then... – Slinky Mar 7 '13 at 14:21
Another idea: # strings /usr/lib64/ | egrep '^/' /etc/pki/tls/certs/ca-bundle.crt – offby1 Aug 30 '13 at 18:57

I found an easy way: use the --cacert with a wrong file name, the output will show the path.


~$ curl --cacert non_existing_file
curl: (77) error setting certificate verify locations:
  CAfile: non_existing_file
  CApath: /etc/ssl/certs
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.