371

Can anyone point me to a good tutorial on installing a root certificate on Ubuntu?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/newdomain.org and place the .crt in that directory. Beyond that I'm not sure how to proceed.

4

9 Answers 9

496

Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu:

  1. Create a directory for extra CA certificates in /usr/local/share/ca-certificates:

    sudo mkdir /usr/local/share/ca-certificates/extra
    
  2. Copy the CA .crt file to this directory:

    sudo cp foo.crt /usr/local/share/ca-certificates/extra/foo.crt
    
  3. Let Ubuntu add the .crt file's path relative to /usr/local/share/ca-certificates to /etc/ca-certificates.conf:

    sudo dpkg-reconfigure ca-certificates
    

    To do this non-interactively, run:

    sudo update-ca-certificates
    

In case of a .pem file on Ubuntu, it must first be converted to a .crt file:

openssl x509 -in foo.pem -inform PEM -out foo.crt

Or a .cer file can be converted to a .crt file:

openssl x509 -inform DER -in foo.cer -out foo.crt
16
  • 15
    Note that Firefox (and maybe some other software) don't use the system-wide certificates, but has its own certificate store: askubuntu.com/a/248326/79344. Jun 6, 2015 at 17:51
  • 2
    sudo dpkg-reconfigure ca-certificates Thanks, the other sudo update-ca-certificates --fresh didn't work on 16.10.
    – antivirtel
    Mar 2, 2017 at 11:29
  • 7
    PEM and crt are two unrelated things. PEM is an encoding (contrast with .DER) while crt is just a naming convention to indicate the contents (contrast with .key)
    – Gerald
    Sep 6, 2018 at 10:09
  • 3
    @Marian I think that conversion command works even when input PEM is actually certificate chain instead of a single X.509 certificate (you cannot be sure what's inside *.pem until reading the content). In that case it is not simple file-copying. Sep 11, 2018 at 20:56
  • 4
    Confirm that for 20.04, these instructions work if the file is put into /usr/share/ca-certificates/extra
    – Raphael
    Jul 8, 2021 at 9:51
270

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem
done.
done.

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

This procedure works also in newer versions: manuals.

13
  • 1
    this seems not to work in trusty tahr 14.04
    – mcantsin
    Mar 28, 2014 at 19:21
  • 33
    Please note that, unlike adding to /usr/share/ca-certificates, this seems to only work if they're directly in /usr/local/share/ca-certificates and not a subdirectory. +1 for using local folder instead of system folder!
    – Tobias J
    Apr 8, 2014 at 5:11
  • 2
    This is documented in README.Debian.
    – pevik
    Aug 24, 2016 at 9:32
  • 1
    I had to do openssl x509 -outform pem -in in_file.pem -out out_file.crt. Got complaints about "multiple certificates" in the CRT file if I did -outform der.
    – Dave Hein
    Dec 29, 2016 at 20:50
  • 3
    Thanks! It works in 18.04 as well, the first answer with copying the crt file /usr/share/ca-certificates/extra doesn't seem to work however.
    – QPTR
    Jan 17, 2019 at 16:25
25

Clarification between update-ca-certificates and dpkg-reconfigure ca-certificates and why one works and the other does not!!

  • update-ca-certificates or sudo update-ca-certificates will only work if /etc/ca-certificates.conf has been updated.

  • /etc/ca-certificate.conf is only updated once you ran dpkg-reconfigure ca-certificates which updates the certificate names to be imported into /etc/ca-certificates.conf.

This is stated in the header of the /etc/ca-certificates.conf file:

# This file lists certificates that you wish to use or to ignore to be
# installed in /etc/ssl/certs.
# update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
#
# This is autogenerated by dpkg-reconfigure ca-certificates.  <=======
# Certificates should be installed under /usr/share/ca-certificates
# and files with extension '.crt' is recognized as available certs.
#
# line begins with # is comment.
# line begins with ! is certificate filename to be deselected.
#
mozilla/ACCVRAIZ1.crt
mozilla/AC_RAIZ_FNMT-RCM.crt
mozilla/Actalis_Authentication_Root_CA.crt
mozilla/AddTrust_External_Root.crt
...

As you can see, the format in /etc/ca-certificates.conf is <folder name>/<.crt name>

So in order to use update-ca-certificates or sudo update-ca-certificates you could do the following to import a .crt:

  1. Create a directory for extra CA certificates in /usr/share/ca-certificates:

     sudo mkdir /usr/share/ca-certificates/extra
    
  2. Copy the .crt file to this directory:

     sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt
    
  3. Append a line to /etc/ca-certificates.conf using <folder name>/<.crt name>:

     echo "extra/foo.crt" | sudo tee -a /etc/ca-certificates.conf
    
  4. Update certs non-interactively with sudo update-ca-certificates

     $ sudo update-ca-certificates
     ...
     Updating certificates in /etc/ssl/certs...
     1 added, 0 removed; done.
    
3
  • For my case with Ubuntu 16.04, No output: locate foo.crt and the output : sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt is: cp: cannot stat 'foo.crt': No such file or directory. Sadly, I first removed ca-certificates. How I can fix it, please?
    – REDHWAN
    Jun 7, 2020 at 3:28
  • On Ubuntu 20.04 LTS, there is no need to use the interactive dpkg-reconfigure ca-certificates. update-ca-certificates adds a certificate from a newly created folder like /usr/local/share/ca-certificates/extra successfully. Mar 3, 2022 at 10:51
14

Install a Certificate Authority on Ubuntu

I have tested this on Ubuntu 14.04.

Here is my solution, I looked and looked for a long time trying to figure out how to get this to work.

  1. Extract the .cer from browser. I used IE 11.
    • Settings -> Internet Options -> Intermediate Certificate Authorities
    • Select The Certificate Authority You Want To Export (certutil -config - -ping will show you the ones you are using if you are behind a corporate proxy)
    • Export -> Select The Format You Want To Use: DER Encoded .cer
  2. Get the .cer files to Ubuntu somehow
  3. Convert to .crt openssl x509 -inform DER -in certificate.cer -out certificate.crt
  4. Make extra directory sudo mkdir /usr/share/ca-certificates/extra
  5. Copy certificates over sudo cp certificate.crt /usr/share/ca-certificates/extra/certificate.crt
  6. sudo update-ca-certificates
  7. If not, then you have to do what I did, go to sudo nano /etc/ca-certificates.conf
  8. Scroll down and find your .cer and remove the ! from in front of the file name (update-ca-certificates doc) - if you don't find your certificate run dpkg-reconfigure ca-certificates
  9. Run sudo update-ca-certificates
  10. You may need to individually trust the CAs from Firefox, Chrome, etc.. , I needed it to work with Docker so after these steps it worked with Docker.
3
  • 1
    does this work in 16.04?
    – endolith
    Oct 14, 2016 at 15:01
  • @endolith worked for me in 16.04.
    – Shubham
    Jul 25, 2017 at 6:19
  • thanks for point no 10 Jun 1, 2020 at 11:08
4

Other answers didn't work for me with Ubuntu 18.04. Append the certificate cert to /etc/ssl/certs/ca-certificates.crt using the following command:

cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificates.crt 
5
  • 1
    2 hours of messing about with import commands before I found this. Perfect!
    – beirtipol
    Feb 14, 2019 at 16:07
  • The command is wrong, the final s is missing: cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificates.crt . Thanks for this solution. Apr 15, 2019 at 14:31
  • 4
    Note: This is the temporary solution, as the added certificate is going to be removed after running update-ca-certificates.
    – kenorb
    May 17, 2019 at 10:49
  • what is removed? I haven't seen my certificate removed. Mar 17, 2021 at 9:24
  • 1
    I get permission denied on this, even with sudo at the beginning: sudo cat DigiCertGlobalRootCA.crt >> /etc/ssl/certs/ca-certificates.crt bash: /etc/ssl/certs/ca-certificates.crt: Permission denied
    – Alex Mi
    Feb 1, 2023 at 19:33
3

Have the (root / CA) certificate available on a web server, local to your network if you like.

  • Browse to it with Firefox.
  • Open the cert and tell Firefox to add it as an exception.
  • Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
  • Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

2
  • 6
    hasn't firefox its own certificate container? If one would add a certificate this way, just firefox would be able to use it, wouldn't it? Mar 23, 2015 at 16:47
  • That does not work at all, you still have to add it to the global cert container of the OS, otherwise it only will be in the Firefox container.
    – arc_lupus
    Apr 4, 2016 at 7:25
1

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

2
  • Should have read more closely... It looks like that's not for root certificates. That page that I linked to though has information about root certificates that might be useful.
    – jat255
    Oct 28, 2011 at 18:06
  • 1
    I don't have a public key and a private key, I just have a .crt so unfortunately those instruction don't seem to apply.
    – Sparky1
    Oct 28, 2011 at 19:01
1

To add a Root CA certificate in FireFox is now-a-days very easy. Just open preferences, go to "Privacy & Security", scroll down to "Certificates" and click "View Certificates...". Here you can click "Import Certificate". Point to your root CA (.pem) and OK. That's all folks.

1

Here are the simple steps:

  1. Install CA certificates to allow SSL-based applications to check for the authenticity of SSL connections:

    sudo apt-get install ca-certificates
    
  2. Copy certificate file (crt or .cer) into /usr/local/share/ca-certificates/ folder, e.g.:

    sudo cp file.crt /usr/local/share/ca-certificates/
    

    For PEM file, see: Convert .pem to .crt and .key.

    Optionally, if using Charles proxy, this command can work:

    curl -L chls.pro/ssl | sudo tee /usr/local/share/ca-certificates/charles.crt
    
  3. Update certificates:

    sudo update-ca-certificates
    

    The command will update /etc/ssl/certs directory to hold SSL certificates and generates ca-certificates.crt file (a concatenated single-file list of certificates).

    Note: Don't add certificates manually (as suggested here), as they are not persistent and going to be removed.

Note: If you're running as root, you can drop the sudo from the above commands.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .