Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem?

5 Answers 5


For system-wide use, OpenSSL should provide you /etc/ssl/certs and /etc/ssl/private. The latter of which will be restricted 700 to root:root.

If you have an application that doesn’t perform initial privilege separation from root, then it might suit you to locate them somewhere local to the application with the relevantly restricted ownership and permissions.

  • 5
    is this standardized somewhere? The file system hierarchy standard doesn't contain it.
    – cweiske
    Dec 4, 2013 at 20:50
  • 3
    @cweiske This seems to be historical OpenSSL convention, not formally standardized, and a very unwieldy one in my opinion. My earliest trace is this version: rpm.pbone.net/index.php3/stat/4/idpl/38501/dir/redhat_other/com/…
    – kubanczyk
    Apr 2, 2015 at 21:20
  • 10
    Worth noting that this is only Debian based distros. Sep 16, 2015 at 8:23
  • 2
    Could I store the SSL certificates (e.g. Let's Encrypt or Cloudflare) for the websites here too? Thanks! Jan 30, 2018 at 18:38
  • 3
    Arch and CentOS also stores ca certs in /etc/ssl/certs as far as I can see Feb 15, 2019 at 4:58

This is where Go looks for public root certificates:

"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
"/etc/pki/tls/cacert.pem",                           // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
"/etc/ssl/cert.pem",                                 // Alpine Linux


"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs",       // FreeBSD
"/etc/pki/tls/certs",           // Fedora/RHEL
"/etc/openssl/certs",           // NetBSD
"/var/ssl/certs",               // AIX

This will vary from distribution to distribution. For example, on Amazon Linux instances (based on RHEL 5.x and parts of RHEL6, and compatible with CentOS), the certificates are stored in /etc/pki/tls/certs and the keys are stored in /etc/pki/tls/private. The CA certificates have their own directory, /etc/pki/CA/certs and /etc/pki/CA/private. For any given distribution, especially on hosted servers, I recommend to follow the already-available directory (and permissions) structure, if one is available.

  • 2
    Same for CentOS7 as well, thank you. Jan 13, 2017 at 15:42

Ubuntu uses /etc/ssl/certs. It also has the command update-ca-certificates which will install certificates from /usr/local/share/ca-certificates.

So installing your custom certificates in /usr/local/share/ca-certificates and running update-ca-certificates seems to be recommended.


  • 1
    /etc/ssl/certs is for root certs. That’s not the place to store a server certificate.
    – chmike
    Oct 23, 2020 at 12:39

If you are looking for a certificate used by your Tomcat instance

  1. Open the server.xml file
  2. Search for SSL/TLS connector
  3. See keystoreFile attribute that contains the path to keystore file.

It looks like

    port="8443" maxThreads="200"
    scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="${user.home}/.keystore" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.