SSL_CERT_DIRECTORY is the directory for the *server* to find the local host public certificate, and SSL_KEY_DIRECTORY is the directory for the *server* to find the local host private key.

These are *not* the directories for the CA certificates. The CA certificate directory is declared as part of the OpenSSL build. Apparently, you built OpenSSL with a different CA certificate directory than you actually used.

If you think about it, you really want to use the CA certificate directory that OpenSSL was built with. Otherwise, each and every program that uses OpenSSL would have to be told where the CA certificates are located as part of their build; nor could you change the CA certificate directory without rebuilding all programs that use OpenSSL.

It makes sense for programs to have configurability of their own certificates (such as the imapd and ipop3d server public certificates and private keys), but not the CA certificates.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

Reply via email to