ubuntu - Can't verify CA certificate unless CApath or CAfile used

Question

Im having trouble with having OpenSSL connect to a server because of trust issues. I placed the CA certificate on /etc/ssl/certs/ and have run sudo c_rehash and can see that the correct file has been made. I can see that CA certificate is in the ca-certificates.crt. However if I run:

openssl s_client -connect servername.domain.com:636

The command fails with Verify return code: 21 (unable to verify the first certificate)

If I do:

openssl s_client -connect servername.domain.com:636 -CApath /etc/ssl/certs/

I get Verify return code: 0 (ok)

What can I do so I dont have to specify the CApath?

I'm using Ubuntu 13.04.

Answer 1

You can also set and export the environment variables SSL_CERT_FILE or SSL_CERT_DIR...

export SSL_CERT_FILE=/path/to/ca_bundle.crt

export SSL_CERT_DIR=/path/to/ca/dir

Then you do not have to specify CAfile or CApath in every openssl command.