title: How to use SSL_CERT_FILE for OpenSSL Windows (OpenSSL 1.0.1c)
body: <p>How (if at all) can one define a single trusted certificate file for OpenSSL 
  on Windows (Win-7, OpenSSL 1.0.1c) using the SSL_CERT_FILE environment variable?</p>
  
  <p>Various research led me to download the December '12 version of Mozilla's
  trusted certificates in PEM format, from here: <a href="http://curl.haxx.se/docs/caextract.html" rel="noreferrer">http://curl.haxx.se/docs/caextract.html</a>
  This contains all of the certs and assorted related info concatenated together
  into one file.</p>
  
  <p>I've found various references to the usage of the environment variables
  SSL_CERT_DIR and SSL_CERT_FILE with respect to other products which rely on
  OpenSSL.  For instance, <a href="http://lynx.isc.org/current/README.sslcerts" rel="noreferrer">http://lynx.isc.org/current/README.sslcerts</a> indicates
  that one can set both of these, and the underlying OpenSSL libraries will use
  them.  However, that hasn't been my experience with the OpenSSL tool itself.</p>
  
  <p>I was able to use SSL_CERT_DIR successfully, but with great pain, as follows.
  I exported (from IE 8) the certificate from www.wellsfargo.com (selected
  randomly), along with the two certificates in its trust chain, both from 
  Verisign.  I put each of the two Verisign certs in a directory C:\ca_stuff,
  and for each, generated a hash thus</p>
  
  <p>openssl x509 -hash -noout -in "Verisign Intl Server.cer"</p>
  
  <p>which had output a302054c, and from this created a link thus</p>
  
  <p>mklink a302054c.0 "Verisign Intl Server.cer"</p>
  
  <p>and likewise for the other Verisign cert.  I then put the Wells Fargo cert. in
  a different directory, and was able to verify it successfully using</p>
  
  <p>set SSL_CERT_DIR=C:\ca_stuff
     openssl verify "Wells Fargo web.cer"</p>
  
  <p>However, after defining SSL_CERT_FILE, pointing to the downloaded cacert.pem
  downloaded from the cURL site, the same command failed.  It did so with and
  without having SSL_CERT_DIR defined.  I verified that the necessary CA
  certificates were in the bundle, and confirmed their serial numbers matched
  those I'd manually extracted from IE.</p>
  
  <p>It seems like an arduous process to manually extract each certificate and put
  it in its own file with a hash link pointing at it.  If this were Unix, I
  could automate it, but on Windows... I've apparently misunderstood something about how to get one big CA cert file working with OpenSSL.</p>
  
  <p>Thank you in advance for any recommendations, insights and assistance.</p>