Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone point me to a good tutorial on installing a root certificate on ubuntu 10 or 11?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/ and place the .crt in that directory. Beyond that I'm not sure how to proceed.

share|improve this question

migrated from Oct 28 '11 at 18:03

This question came from our site for professional and enthusiast programmers.

If anybody is landing here with a cer file instead of a crt, they're the same thing (just with a different extension). You should be able to follow these answers and just substitute the filename. – Oli Jan 23 '14 at 10:19
up vote 109 down vote accepted

Installing a root/CA Certificate

Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu:

  1. Create a directory for extra CA certificates in /usr/share/ca-certificates:

    sudo mkdir /usr/share/ca-certificates/extra
  2. Copy the CA .crt file to this directory:

    sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt
  3. Let Ubuntu add the .crt file's path relative to /usr/share/ca-certificates to /etc/ca-certificates.conf:

    sudo dpkg-reconfigure ca-certificates
share|improve this answer
Doesn't it automatically do the 4th command when doing the 3rd? – Andrey Regentov Aug 14 '13 at 9:29
How about using /usr/local/share/ca-certificates (local!) instead of using a system package management managed directoy? – gertvdijk Mar 31 '14 at 13:03
Could add the following step to ensure the cert is in pem format? openssl x509 -inform DER -outform PEM -in foo.crt -out foo.pem – steakunderscore Feb 1 '15 at 20:53
Note that Firefox (and maybe some other software) don't use the system-wide certificates, but has its own certificate store: – Amir Ali Akbari Jun 6 '15 at 17:51
Note that the file must be in PEM format and have ".crt" extension. – Anton Jun 5 at 7:07

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

share|improve this answer
this seems not to work in trusty tahr 14.04 – mcantsin Mar 28 '14 at 19:21
Please note that, unlike adding to /usr/share/ca-certificates, this seems to only work if they're directly in /usr/local/share/ca-certificates and not a subdirectory. +1 for using local folder instead of system folder! – Toby J Apr 8 '14 at 5:11
Use this command to convert *.pem to *.crt: openssl x509 -outform der -in in_file.pem -out out_file.crt – Nelson G. Jun 1 at 10:20

Have the (root / CA) certificate available on a web server, local to your network if you like.

  • Browse to it with Firefox.
  • Open the cert and tell Firefox to add it as an exception.
  • Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
  • Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

share|improve this answer
hasn't firefox its own certificate container? If one would add a certificate this way, just firefox would be able to use it, wouldn't it? – Aiyion.Prime Mar 23 '15 at 16:47
That does not work at all, you still have to add it to the global cert container of the OS, otherwise it only will be in the Firefox container. – arc_lupus Apr 4 at 7:25

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

share|improve this answer
Should have read more closely... It looks like that's not for root certificates. That page that I linked to though has information about root certificates that might be useful. – jat255 Oct 28 '11 at 18:06
I don't have a public key and a private key, I just have a .crt so unfortunately those instruction don't seem to apply. – Sparky1 Oct 28 '11 at 19:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.