x590cafile default location for gnutls-cli

Question

I am using gnutls-cli from Cygwin, on a laptop running Windows XP Home (I have openssl from cygwin also). I am wondering where does gnutls-cli look for CA certificates if I don't specify option --x509cafile? I haven't found the answer anywhere. I can point to my CA certificate bundle at /usr/ssl/certs & successfully verify certificates (e.g. those from AT&T Yahoo email for inbound.att.net), but I'm still wondering where does gnutls-cli look if I don't specify where to look?

Answer 1

It should use /usr/ssl/certs/ca-bundle.crt (from the ca-certificates package), but it seems the Cygwin gnutls package is not configured to use a CA certificate bundle by default. I just raised this with the Cygwin gnutls maintainer; hopefully this will be fixed in a future release.