Where is Golang picking up root CAs from?

Question

crypto/tls.Config.RootCAs states

// RootCAs defines the set of root certificate authorities
// that clients use when verifying server certificates.
// If RootCAs is nil, TLS uses the host's root CA set.

On Linux, where are "the host's root CA set" picked up from? I need to know this to be able to globally add another root CA to trust.

This is a system configuration thing; Go has nothing to do with it. It's the same for all programming languages, and depends on how your system is configured. — joshlf, Oct 14 '16 at 20:19
Well, on Darwin, the relevant file is in the `x509` package: [`root_cgo_darwin.go`](https://golang.org/src/crypto/x509/root_cgo_darwin.go) — joshlf, Oct 14 '16 at 20:21

score 65 · Accepted Answer · edited Jun 23 '20 at 23:30

It searches through the following locations: https://golang.org/src/crypto/x509/root_linux.go

excerpt

// Copyright 2015 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package x509

// Possible certificate files; stop after finding one.
var certFiles = []string{
    "/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
    "/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
    "/etc/ssl/ca-bundle.pem",                            // OpenSUSE
    "/etc/pki/tls/cacert.pem",                           // OpenELEC
    "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
    "/etc/ssl/cert.pem",                                 // Alpine Linux
}

Note that additional root keys are read from the files in the directories `certDirectories` defined in the same .go-file. Specifically, this list includes `/etc/ssl/certs` and `/etc/pki/tls/certs`. Both `certFiles` and `certDirectories` can be overridden with environment variables (`SSL_CERT_FILE` and `SSL_CERT_DIR`, respectively). — matz, Aug 11 '21 at 08:00

score 10 · Answer 2 · answered May 20 '21 at 14:34

10

You can also set environment variable "SSL_CERT_FILE" to let Golang use your custom certificate file.

answered May 20 '21 at 14:34

Linden X. Quan

584
5
18

is it going to override existing ones or just add it additionally? – Samet Baskıcı May 18 '23 at 21:39
sorry I don't remember. I no longer use golang now. – Linden X. Quan May 22 '23 at 01:03

score 5 · Answer 3 · answered May 14 '21 at 20:33

In the more recent versions of Golang, in addition to the above already mentioned certificate paths, Golang will also search for a common set of directories for any cert PEMs:

/etc/ssl/certs                 // SLES10/SLES11
/etc/pki/tls/certs             // Fedora/RHEL
/system/etc/security/cacerts   // Android

The paths for Linux OS are defined here: https://golang.org/src/crypto/x509/root_linux.go. The actual lookup and adding of certs happens here: https://golang.org/src/crypto/x509/root_unix.go.

score 4 · Answer 4 · answered Feb 25 '20 at 02:24

These are the locations; stop after finding one:

"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
"/etc/pki/tls/cacert.pem",                           // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
"/etc/ssl/cert.pem",                                 // Alpine Linux

Where is Golang picking up root CAs from?

4 Answers4

Linked