When would one use the --cacert option vs. the --capath option within curl (CLI that is).

--cacert appears to reference a monolithic file that contains multiple PEMs. Assume it scans through to find the matching hostname?

--capath appears to reference a directory in which multiple files live. Does curl pick up the appropriate certificate as a filename therein?


From the docs:

--cacert (HTTPS) Tells curl to use the specified certificate file to verify the peer. The file may contain multiple CA certificates. The certificate(s) must be in PEM format. If this option is used several times, the last one will be used.

--capath (HTTPS) Tells curl to use the specified certificate directory to verify the peer. The certificates must be in PEM format, and the directory must have been processed using the c_rehash utility supplied with openssl. Certificate directories are not supported under Windows (because c_rehash uses symbolink links to create them). Using --capath can allow curl to make https connections much more efficiently than using --cacert if the --cacert file contains many CA certificates. If this option is used several times, the last one will be used.

So, if you specify --cacert, the CA certs are stored in the specified file. These CA certificates are used to verify the certs of remote servers that cURL connects to.

The --capath option is used to specify a directory containing the CA certs rather than a single file. The c_rehash utility should be used to prepare the directory i.e., create the necessary links. The main benefit of using --capath would appear to be that it's more efficient than the --cacert single file approach if you have many CA certs.

Here's a script that probably does what c_rehash does:


With both options you should be careful to only include CA certs from CAs you trust. If for example, you know the remote servers should always be issued with certs from YourCompanyCA, then this is the only CA cert you should include.

  • Why more efficient? Because it can lookup the cert via the filesytem name? – Jé Queue Mar 27 '12 at 0:13
  • @Xepoch Yes, I think it creates files with the hash of the subject name of each cert and then links these hash files back to the original cert. This makes lookups faster. I've added a small script that probably does what c_rehash does to perhaps make it clearer. – PhilR Mar 27 '12 at 6:28
  • Since Ubuntu has a ca certificate directory, if I want to download the most recent ca-bundle.crt from Curl Haxx website, then what should I be doing? Just dropping the file into the directory and running that command? Or is there some ubuntu specific configuration required? – CMCDragonkai Dec 11 '15 at 9:56
  • 2018 Update: The --capath option apparently now is supported on Windows. – kralyk Feb 13 '18 at 18:08

On Windows you can run the following as a batch file and pass in the capath folder name:


@echo off
setlocal enableextensions enabledelayedexpansion
if \%1\ EQU \\ goto :usage
pushd %1
if NOT ERRORLEVEL 0 goto :usage
del *.0
for %%I in (*.pem) do call :hash %%I
goto :eof
for /F "usebackq" %%J in (`openssl x509 -in %1 -hash -noout`) do mklink %%J.0 %1
goto :eof
echo Usage:
echo Rehash a folder of x509 Certificates for Curl
echo %~n0 ^<Folder^>


c_rehash c:\cacerts

Your Answer

