Hi again, i was wondering is anyone working with sub certificates? For our project when using the broker CLI we locally use the _*SSL_CERT_FILE*_ system variable. This worked fine, but when we updated to new certificates we got SUB certificates. I struggled to get it to work with the ROOT certificate, it just didn't work. Then i tried to set a directory instead with _*SSL_CERT_DIR*_, i stored my old, new ROOT and new SUB in there but that didn't work. Ultimately, i took these 3 certificates contents and merged them into one certificate.pem file and used _*SSL_CERT_FILE*_ again. This did the trick, i am just wondering is this expected?

I had some notes on the use of SSL_CERT_DIR, when testing it out with gitea, and ruby. It didn’t work unless I followed some pre-reqs

Your understanding of the _SSL_CERT_DIR_ environment variable is correct. The directory that is specified in the variable is meant for trusted root certificates (but not for intermediate ones!).

When copying the root certificates over to this directory, they have to follow a certain naming convention. The certificate should be in the regular PEM format, but the file name must be named

[HASH].0

where [HASH] is the hashed value of the certificate’s subject. You can find out this hash value with the following command (replace root.cer with the file name of your root certificate)

openssl x509 -subject_hash -in root.cer

for me with gitea

gitea cert --host git

 ls
   cert.pem           key.pem   

openssl x509 -subject_hash -in cert.pem
	43b31b52

cp cert.pem 43b31b52.0
SSL_CERT_DIR=$PWD curl <https://git/>

How were the certs setup in your SSL_CERT_DIR?

The certs where just lose .pem files with one certification inside, and then stored in a folder (dir). i did not do any of this fancy stuff 🙂

Does your use of the SSL_CERT_DIR work with anything else? with Curl? I imagine it won’t. that it what I found from testing and my ref sources are below. it seemed I wrongly assumed I could just move the file in a dir, update to SSL_CERT_DIR and bingo, but that wasn’t the case. https://unix.stackexchange.com/a/698873 https://stackoverflow.com/a/73949796 https://documentation.sas.com/doc/en/calcdc/3.1/secref/p0exqtnxh7wjdxn1kvq5os1sogp9.htm

no i am only using SSL_CERT_FILE or SSL_CERT_DIR for Pact