Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Can anyone point me to a good tutorial on installing a root certificate on ubuntu 10 or 11?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/newdomain.org and place the .crt in that directory. Beyond that I'm not sure how to proceed.

share|improve this question

migrated from stackoverflow.com Oct 28 '11 at 18:03

This question came from our site for professional and enthusiast programmers.

If anybody is landing here with a cer file instead of a crt, they're the same thing (just with a different extension). You should be able to follow these answers and just substitute the filename. –  Oli Jan 23 '14 at 10:19

4 Answers 4

up vote 63 down vote accepted

Installing a root/CA Certificate

Given a CA ceritificate file 'foo.crt', follow these steps to install it on Ubuntu:

  1. Create a directory for extra CA certificates in /usr/share/ca-certificates

    sudo mkdir /usr/share/ca-certificates/extra
  2. Copy the '.crt' file to the directory

    sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt
  3. Let Ubuntu add the '.crt' file's path relative to /usr/share/ca-certificates to /etc/ca-certificates.conf

    sudo dpkg-reconfigure ca-certificates
share|improve this answer
Doesn't it automatically do the 4th command when doing the 3rd? –  Andrey Regentov Aug 14 '13 at 9:29
@VernBurton I recommend you to do your own answer if possible. –  Braiam Oct 10 '13 at 15:49
How about using /usr/local/share/ca-certificates (local!) instead of using a system package management managed directoy? –  gertvdijk Mar 31 '14 at 13:03
Could add the following step to ensure the cert is in pem format? openssl x509 -inform DER -outform PEM -in foo.crt -out foo.pem –  steakunderscore Feb 1 at 20:53

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

share|improve this answer
if it doesn't work: the script .crt files, and ignores .pem files. rename your file if you want to install a root CA. –  Attila Lendvai Nov 27 '13 at 6:21
this seems not to work in trusty tahr 14.04 –  mcantsin Mar 28 '14 at 19:21
@AttilaLendvai Spot on! Took me half an hour to find out why it was ignoring my .pem files. –  gertvdijk Mar 31 '14 at 13:09
Please note that, unlike adding to /usr/share/ca-certificates, this seems to only work if they're directly in /usr/local/share/ca-certificates and not a subdirectory. +1 for using local folder instead of system folder! –  Toby J Apr 8 '14 at 5:11

Have the (root / CA) certificate available on a web server, local to your network if you like.

  • Browse to it with Firefox.
  • Open the cert and tell Firefox to add it as an exception.
  • Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
  • Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

share|improve this answer
hasn't firefox its own certificate container? If one would add a certificate this way, just firefox would be able to use it, wouldn't it? –  Aiyion.Prime Mar 23 at 16:47

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

share|improve this answer
Should have read more closely... It looks like that's not for root certificates. That page that I linked to though has information about root certificates that might be useful. –  jat255 Oct 28 '11 at 18:06
I don't have a public key and a private key, I just have a .crt so unfortunately those instruction don't seem to apply. –  Sparky1 Oct 28 '11 at 19:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.