Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem?



For system wide use OpenSSL should provide you /etc/ssl/certs and /etc/ssl/private. The latter of which will be restricted 700 to root:root.

If you have an application not performing an initial privsep from root then it might suit you to locate them somewhere local to the application with the relevantly restricted ownership and permissions.

  • 4
    is this standardized somewhere? The file system hierarchy standard doesn't contain it. – cweiske Dec 4 '13 at 20:50
  • 1
    @cweiske This seems to be historical OpenSSL convention, not formally standardized, and a very unwieldy one in my opinion. My earliest trace is this version: rpm.pbone.net/index.php3/stat/4/idpl/38501/dir/redhat_other/com/… – kubanczyk Apr 2 '15 at 21:20
  • 5
    Worth noting that this is only Debian based distros. – Joshua Griffiths Sep 16 '15 at 8:23
  • 2
    Could I store the SSL certificates (e.g. Let's Encrypt or Cloudflare) for the websites here too? Thanks! – Vladyslav Turak Jan 30 '18 at 18:38
  • Arch and CentOS also stores ca certs in /etc/ssl/certs as far as I can see – theferrit32 Feb 15 at 4:58

This is where Go looks for public root certificates:

"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
"/etc/pki/tls/cacert.pem",                           // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7


"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs",       // FreeBSD
"/etc/pki/tls/certs",           // Fedora/RHEL
"/etc/openssl/certs",           // NetBSD

This will vary from distribution to distribution. For example, on Amazon Linux instances (based on RHEL 5.x and parts of RHEL6, and compatible with CentOS), the certificates are stored in /etc/pki/tls/certs and the keys are stored in /etc/pki/tls/private. The CA certificates have their own directory, /etc/pki/CA/certs and /etc/pki/CA/private. For any given distribution, especially on hosted servers, I recommend to follow the already-available directory (and permissions) structure, if one is available.

  • 1
    Same for CentOS7 as well, thank you. – Jacob Evans Jan 13 '17 at 15:42

If you are looking for a certificate used by your Tomcat instance

  1. Open the server.xml file
  2. Search for SSL/TLS connector
  3. See keystoreFile attribute that contains the path to keystore file.

It looks like

    port="8443" maxThreads="200"
    scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="${user.home}/.keystore" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS" />

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.