Where Does Go Get Its Root CA Certificates on Linux?

Golang Root CA Acquisition on Linux

The crypto/tls.Config.RootCAs parameter allows clients to define a specific set of root CAs to use for server certificate verification. However, if RootCAs is left unset, the default behavior is to rely on the host's root CA set.

On Linux, where does Golang derive the host's root CA set from? This knowledge is crucial for enabling global trust of additional root CAs.

Golang searches for root CA certificates in the following locations:

• /etc/ssl/certs/ca-certificates.crt
• /etc/pki/tls/certs/ca-bundle.crt
• /etc/ssl/ca-bundle.pem
• /etc/pki/tls/cacert.pem
• /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
• /etc/ssl/cert.pem

The search stops as soon as one valid certificate file is found. This allows system administrators to customize the list of trusted root CAs, including the ability to add or remove specific authorities.

By default, Golang uses the system-provided root CA certificates. However, if you need to accommodate specific security requirements, you can modify this list by creating or editing one of the aforementioned certificate files. Remember to verify the validity and authenticity of any new root CAs before incorporating them into your trust store.

The above is the detailed content of Where Does Go Get Its Root CA Certificates on Linux?. For more information, please follow other related articles on the PHP Chinese website!