The X509 certificate store holds trusted CA certificates used to verify peer certificates.

The easiest way to create a useful certificate store is:

cert_store =

This will use your system’s built-in certificates.

If your system does not have a default set of certificates you can obtain a set extracted from Mozilla CA certificate store by cURL maintainers here: (You may wish to use the script to extract the certificates from a local install to avoid man-in-the-middle attacks.)

After downloading or generating a cacert.pem from the above link you can create a certificate store from the pem file like this:

cert_store =
cert_store.add_file 'cacert.pem'

The certificate store can be used with an SSLSocket like this:

ssl_context =
ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
ssl_context.cert_store = cert_store

tcp_socket = '', 443

ssl_socket = tcp_socket, ssl_context

The callback for additional certificate verification. It is invoked for each certificate in the chain and can be used to implement custom certificate verification conditions.

The callback is invoked with two values, a boolean that indicates if the pre-verification by OpenSSL has succeeded or not, and the StoreContext in use.

The callback can use StoreContext#error= to change the error code as needed. The callback must return either true or false.

NOTE: any exception raised within the callback will be ignored.

See also the man page X509_STORE_CTX_set_verify_cb(3).


The error code set by the last call of verify.

See also StoreContext#error.

The description for the error code set by the last call of verify.

See also StoreContext#error_string.


The certificate chain constructed by the last call of verify.

See also StoreContext#chain.

Class Methods

Creates a new X509::Store.

Instance Methods

Adds the OpenSSL::X509::Certificate cert to the certificate store.

See also the man page X509_STORE_add_cert(3).

Adds the OpenSSL::X509::CRL crl to the store.

See also the man page X509_STORE_add_crl(3).

Adds the certificates in file to the certificate store. file is the path to the file, and the file contains one or more certificates in PEM format concatenated together.

See also the man page X509_LOOKUP_file(3).

Adds path as the hash dir to be looked up by the store.

See also the man page X509_LOOKUP_hash_dir(3).

Sets the default flags used by certificate chain verification performed with the Store.

flags consists of zero or more of the constants defined in OpenSSL::X509 with name V_FLAG_* or’ed together.

OpenSSL::X509::StoreContext#flags= can be used to change the flags for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_flags(3).

Sets the store’s default verification purpose. If specified, the verifications on the store will check every certificate’s extensions are consistent with the purpose. The purpose is specified by constants:










OpenSSL::X509::StoreContext#purpose= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_purpose(3).

Configures store to look up CA certificates from the system default certificate store as needed basis. The location of the store can usually be determined by:



See also the man page X509_STORE_set_default_paths(3).

Sets the time to be used in the certificate verifications with the store. By default, if not specified, the current system time is used.

OpenSSL::X509::StoreContext#time= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_time(3).

Sets the default trust settings used by the certificate verification with the store.

OpenSSL::X509::StoreContext#trust= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_trust(3).

Performs a certificate verification on the OpenSSL::X509::Certificate cert.

chain can be an array of OpenSSL::X509::Certificate that is used to construct the certificate chain.

If a block is given, it overrides the callback set by verify_callback=.

After finishing the verification, the error information can be retrieved by error, error_string, and the resulting complete certificate chain can be retrieved by chain.

General callback for OpenSSL verify