OS : archlinuxOpenssl dir : /etc/sslI just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash:$ openssl s_client  -connect vimeo.com:443It shows:SSL-Session:    Protocol  : TLSv1.2    Cipher    : RC4-MD5    Session-ID: 001635EF0132A25577F3799825F2698A8FEDCDF916393DB44E9FCC5701D5E310    Session-ID-ctx:     Master-Key: C5AA72B1E0A805AA950D1E0EFC7565F0EF3949618927EA84081B65E65B664C7AB803757CFF1CB12333CB8FC7D8298BA6    Key-Arg   : None    PSK identity: None    PSK identity hint: None    SRP username: None    Start Time: 1394981067    Timeout   : 300 (sec)    Verify return code: 20 (unable to get local issuer certificate)And if I explicitly set the CA file: $ openssl s_client  -connect vimeo.com:443 -CAfile XXX.pemSSL-Session:    Protocol  : TLSv1.2    Cipher    : RC4-MD5    Session-ID: BF58BED9C13FF42E5DDEBC938CED703CD81A96EC59442B91FC6669D31D13E510    Session-ID-ctx:     Master-Key: 197D80168908A8491C26F27B1C5AAA29BE2DC9CCBB8B840BAA45FCE683BDDB95133E58A48EDAC5AF820C97C948D436E2    Key-Arg   : None    PSK identity: None    PSK identity hint: None    SRP username: None    Start Time: 1394981110    Timeout   : 300 (sec)    Verify return code: 0 (ok)Have I successfully installed the certificates? Why must I specify the CA file?
Installed root certificate authority doesn't appear to be working?
arch linux;openssl;certificates
This works for me on Fedora 19.$ openssl s_client  -connect vimeo.com:443 < /dev/nullSSL-Session:    Protocol  : TLSv1.2    Cipher    : RC4-MD5    Session-ID: 2345C651AB00DC97DF7390227CFA1EE8FD4F35EDCB142C4EB053F01380890514    Session-ID-ctx:     Master-Key: B1BD06863BD3CEF2C2963AF47E5269DFE19A650A27A1A7D9032D361D34C3AFC914E59FBABEAE8087AD47D6EFC067548D    Key-Arg   : None    Krb5 Principal: None    PSK identity: None    PSK identity hint: None    Start Time: 1394988228    Timeout   : 300 (sec)    Verify return code: 0 (ok)---DONEI would debug your issue further using strace to confirm that openssl is picking up the added .pem files from the directory you think it is.$ strace -s 2000 -o ssl.log openssl s_client  -connect vimeo.com:443 < /dev/nullYou can then interrogate the resulting log file, ssl.log, looking to find out where openssl the executable is accessing it's PEM files.open(/etc/pki/tls/openssl.cnf, O_RDONLY) = 3fstat(3, {st_mode=S_IFREG|0644, st_size=10906, ...}) = 0mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9c0277e000...open(/etc/pki/tls/cert.pem, O_RDONLY) = 3fstat(3, {st_mode=S_IFREG|0444, st_size=235586, ...}) = 0mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9c0277e000...I'd also pay special attention to the permissions of the files you've added as well as making sure that openssl's configuration file, /etc/pki/tls/openssl.cnf, is referencing the correct directory:...[ ca ]default_ca  = CA_default        # The default ca section####################################################################[ CA_default ]dir     = /etc/pki/CA       # Where everything is keptcerts       = $dir/certs        # Where the issued certs are keptcrl_dir     = $dir/crl      # Where the issued crl are keptdatabase    = $dir/index.txt    # database index file....