LINUX - Add certificates to CA file

De PedroWiki

Introduction

You may need, at some point, to manually add some certs to the system CA store.

Use cases:

  • self signed certs for instance,
  • or certs associated to a local/internal PKI,
  • or CA certs not known by default by your system.
  • ...

How to add cert?

Ubuntu

See this manpage about update-ca-certificate command.

CA Cert

Steps:

  • get the cert(s) you want to add, and create files
vi mycert.pem
  • put those files in a subfolder of /usr/share/ca-certificates/
mkdir /usr/share/ca-certificates/mysubfolder
mv mycert.pem /usr/share/ca-certificates/mysubfolder/
  • edit /etc/ca-certificates.conf and add 1 line per new cert at the end of the file
mysubfolder/mycert.pem
  • finally, update the CA store with the appropriate command:
root@mymachine:/usr/share/ca-certificates/manitou# update-ca-certificates
Updating certificates in /etc/ssl/certs...
...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Local cert

  • If needed rename your cert(s) file(s) with a .crt extension.
  • Then place it in /usr/share/local/ca-certificates/.
  • Finally update the store
update-ca-certificates --fresh