title: How can I split a CA certificate bundle into separate files?
body: <p>I'm working with OpenSSL and need a sane default list of CAs. I'm using Mozilla's list of trusted CAs, as <a href="http://curl.haxx.se/docs/caextract.html">bundled by cURL</a>. However, I need to split this bundle of CA certs, because the <a href="https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html">OpenSSL documentation says</a>:</p>
  
  <blockquote>
    <p>If CApath is not NULL, it points to a directory containing CA certificates in PEM format. The files each contain one CA certificate. The files are looked up by the CA subject name hash value, which must hence be available.</p>
  </blockquote>
  
  <p>For example, using the <code>ca-bundle.crt</code> file directly works fine:</p>
  
  <pre><code>openssl-1.0.1g&gt; ./apps/openssl s_client -connect www.google.com:443 -CAfile /home/user/certs/ca-bundle.crt
  ...
      Verify return code: 0 (ok)
  ---
  DONE
  </code></pre>
  
  <p>But specifying the directory containing the <code>ca-bundle.crt</code> file does not work:</p>
  
  <pre><code>openssl-1.0.1g&gt; ./apps/openssl s_client -connect www.google.com:443 -CApath /opt/aspera/certs
      Verify return code: 20 (unable to get local issuer certificate)
  ---
  DONE
  </code></pre>
  
  <p>I presume this is because my folder doesn't adhere to what the documentation asks for (namely, a directory containing CA certs in PEM format, with each file containing one cert, named by hash value). My directory just has the single bundle of certs.</p>
  
  <p>How can I split my bundle of certs to adhere to OpenSSL's request that each cert be in an individual file? Bonus points if the hashing can be done too (though if needed I could write a script to do that myself if all the certs are in individual files).</p>