LINUX - Add certificates to CA file

Introduction

You may need, at some point, to manually add some certs to the system CA store.

Use cases:

• self signed certs for instance,
• or certs associated to a local/internal PKI,
• or CA certs not known by default by your system.
• ...

How to add cert?

Ubuntu

See this manpage about update-ca-certificate command.

CA Cert

Steps:

• get the cert(s) you want to add, and create files

vi mycert.pem

• put those files in a subfolder of /usr/share/ca-certificates/

mkdir /usr/share/ca-certificates/mysubfolder
mv mycert.pem /usr/share/ca-certificates/mysubfolder/

• edit /etc/ca-certificates.conf and add 1 line per new cert at the end of the file

mysubfolder/mycert.pem

• finally, update the CA store with the appropriate command:

root@mymachine:/usr/share/ca-certificates/manitou# update-ca-certificates
Updating certificates in /etc/ssl/certs...
...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Local cert

• If needed rename your cert(s) file(s) with a .crt extension.
• Then place it in /usr/share/local/ca-certificates/.
• Finally update the store

update-ca-certificates --fresh

Environment variable

You may have to set an environment variable for some third party apps to properly work with this CA store (Ansible, Python...):

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

Think about adding this environment variable to your .bashrc file for instance.