clicklog

OpenSSL がどこへデフォルトの証明書を探しに行くかを調べた。
Google CodeSearch はわりと便利だった。

apps/verify.c

if (CAfile) {
  i=X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM);
    if(!i) {
      BIO_printf(bio_err, "Error loading file %s\n", CAfile);
      ERR_print_errors(bio_err);
      goto end;
    }
  } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);

crypto/x509/x509_vfy.h

#define X509_LOOKUP_load_file(x,name,type) \
           X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL)

crypto/x509/by_file.c

case X509_L_FILE_LOAD:
  if (argl == X509_FILETYPE_DEFAULT)
    {
      file = (char *)Getenv(X509_get_default_cert_file_env());
        if (file)
          ok = (X509_load_cert_crl_file(ctx,file,
                        X509_FILETYPE_PEM) != 0);
        else
	  ok = (X509_load_cert_crl_file(ctx,X509_get_default_cert_file(),
                        X509_FILETYPE_PEM) != 0);

crypto/x509/x509_def.c

const char *X509_get_default_cert_file(void)
      { return(X509_CERT_FILE); }

const char *X509_get_default_cert_file_env(void)
      { return(X509_CERT_FILE_EVP); }

crypto/cryptlib.h

#define X509_CERT_DIR		OPENSSLDIR "/certs"
#define X509_CERT_FILE		OPENSSLDIR "/cert.pem"
#define X509_PRIVATE_DIR	OPENSSLDIR "/private"

crypto/opensslconf.h

#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
#define OPENSSLDIR "/usr/local/ssl"
#endif