A trusted CA certificates generator for BearSSL applications, providing a ready-to-use C source file with trusted root certificates compatible with virtually any website.
| File | Version | Date |
|---|---|---|
| BearSSLTrustedAnchors.c | 2025-8-6 | 2025/08/06 |
This project generates trusted anchor certificates for BearSSL from multiple CA sources, maximizing compatibility with public websites, government portals, and enterprise services. The generated C source file contains all trusted root certificates in a format that can be directly compiled into BearSSL applications.
The trusted anchors are generated by combining:
| # | Source | Description |
|---|---|---|
| 1 | Mozilla CA Bundle (curl.se/ca/cacert.pem) |
Primary bundle — covers the vast majority of public websites |
| 2 | System CA bundle (auto-detected) | Adds national, governmental, and corporate CAs not present in Mozilla's bundle |
System bundle auto-detection order:
| Path | Distribution |
|---|---|
/etc/ssl/certs/ca-certificates.crt |
Debian / Ubuntu |
/etc/pki/tls/certs/ca-bundle.crt |
RHEL / CentOS / Fedora |
/etc/ssl/ca-bundle.pem |
openSUSE |
/etc/ssl/cert.pem |
Alpine / macOS |
To generate an updated certificate file:
sh generator.shThis script will:
- Download the latest CA certificate bundle from Mozilla
- Merge it with the system CA bundle (if available)
- Convert the combined bundle to BearSSL format using the
brssltool - Generate the
BearSSLTrustedAnchors.cfile
- BearSSL tools (
brssl) curlfor downloading certificatesbashshell