certifi

This Erlang library contains a CA bundle that you can reference in your Erlang application. This is useful for systems that do not have CA bundles that Erlang can find itself, or where a uniform set of CAs is valuable.

This an Erlang specific port of certifi. The CA bundle is derived from Mozilla's canonical set.

The bundled 118 certificates were verified on 2026-10-23 against the Mozilla CA bundle published by curl, dated 2026-10-20. The distrusted emSign C1, C3, and G3 roots are excluded.

Usage

CaCerts = certifi:cacerts(),
SslOptions = [{verify, verify_peer},
              {depth, 99},
              {cacerts, CaCerts}],
ssl:connect( "example.com", 443, SslOptions ).

You can also retrieve the path to the file and load it by yourself if needed:

Path = certifi:cacertfile().

Changelog

See CHANGELOG.md.

Development

Update the CA bundle from curl's Mozilla extraction (requires curl and OpenSSL):

make update
rebar3 clean
rebar3 eunit

The update verifies the published SHA-256 checksum and parses the certificates before replacing priv/cacerts.pem. Review changes to the trust roots and update the test expectations before committing. Clean before rebuilding because the certificates are embedded into the module at compile time.

Testing:

rebar3 eunit

Documentation:

rebar3 ex_doc