system_root_certificates/1

Availability::- use_module(library(ssl)).(can be autoloaded)

[det]system_root_certificates(-List)

List is a list of trusted root certificates as provided by the OS. This is the list used by ssl_context/3 when using the option system(root_certificates). The list is obtained using an OS specific process. The current implementation is as follows:

On Windows, CertOpenSystemStore() is used to import the "ROOT" certificates from the OS.
On Unix and macOS, certificates are loaded from a file defined by the Prolog flag system_cacert_filename. The initial value of this flag is established at build time and is /etc/ssl/cert.pem on macOS. For security reasons, the flag can only be set prior to using the SSL library. For example:
```
:- use_module(library(ssl)).
:- set_prolog_flag(system_cacert_filename,
                   '/home/jan/ssl/ca-bundle.crt').
```
On macOS the flag may be set to keychain, in which case the trust anchors are obtained from the keychain using SecTrustCopyAnchorCertificates(). This is also used as fallback if the file above does not exist or holds no certificates. It is not the default because this API talks to the securityd daemon over Mach IPC, which can block indefinitely if the keychain is not accessible, e.g., in an ssh session while the login keychain is locked. Such a block cannot be interrupted using e.g. call_with_time_limit/2.

Note that a PEM file is a plain list of certificates. Unlike the keychain it cannot express trust settings made by the user or the administrator, e.g., root certificates that have been distrusted.

If no certificates can be obtained at all a warning is printed and List is unified with [], which makes all certificate verification fail.

History

Fixed in 10.1.15 (👉517c743) macOS HTTPS hang in system_root_certificates/1