That error is because openssl.exe wants you to tell it where to get root CA certs. In *nix it's easy since those are files, but in Windows those are stored as registry entries.
You can download them from the internet, or if you run Certificate Manager you can grab them from your own computer. Win+R > certmgr opens the program, and then Certificates - Local Computer > Trusted Root Certification Authorities > Certificates opens the list. From there select the appropriate Certificate Authority (as an example, if you're authenticating against LetsEncrypt / Certbot, the CA in 2021 is "ISRG Root X1"). Right Click > All Tasks > Export brings up the Export Wizard, and "Base-64 encoded X.509" will get you a pem file you can save out.
If you only need to check against a single CA, you're now basically done. Run openssl.exe with the option
-CAfile x:/path/to/your/new/file.cer and you as long as your file is the correct Root CA you shouldn't get that error.
But what you asked about was
-CApath which allows you to have multiple CA files and it will check against whichever is appropriate. Using this method on Windows has one extra step. The documentation for s_client says the directory you point to must be in "hash format" and to check the documentation for verify which says files must be named in the format "hash.0" as described in the documentation for x509 which gives us our answer: the directory pointed to by
-CApath can't just have files with any old names, they must be named based on their encrypted "Certificate Subject Names" which you can get from
As an example, if you'd exported a .cer file of the ISRG Root X1 cert to
C:\certs\lets.cer, you could either run the command
openssl.exe s_client -CAfile C:\certs\lets.cer -connect servername:443
Or if you wanted to create a directory of certificates, you'd first run
openssl.exe x509 -subject_hash -in C:\certs\lets.cer
Which gives you the hash
4042bcee (and a printout of the certificate)
So you'd rename the .cer file to
C:\certs\4042bcee.0 (or make a copy, or a symlink etc)
And then you can run
openssl.exe s_client -connect servername:443 -CApath C:\certs\
Also, if you don't want to specify the
-CApath every time, you can check the default path with
openssl.exe version -a which on my Win10 system is
OPENSSLDIR: "C:\Program Files\Common Files\SSL"
and put the specially-named files into a subfolder
\certs of that, so in my case on Win10
C:\Program Files\Common Files\SSL\certs