Hot answers tagged

109

Installing a root/CA Certificate Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu: Create a directory for extra CA certificates in /usr/share/ca-certificates: sudo mkdir /usr/share/ca-certificates/extra Copy the CA .crt file to this directory: sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt Let Ubuntu add the ....


64

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu: First, copy your CA to dir /usr/local/share/ca-certificates/ sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt then, update CA store sudo update-ca-certificates That's all. You should get this output: Updating certificates in /etc/ssl/certs... 1 added, 0 removed;...


14

Run sudo dpkg-reconfigure ca-certificates That should give you a list where you can deselect CAs. The list of CAs is stored in the file /etc/ca-certificates.conf. If you edit this file manually you need to run sudo update-ca-certificates to update the actual certificates in /etc/ssl/certs/ (if you use dpkg-reconfigure that is done automatically). ...


12

The problem here is that Firefox does not have a 'central' location where it looks for certificates. It just looks into the current profile. That's why modifying /usr/share/ca-certificates or other similar directories won't work with Firefox. This is something that has been requested for years; see issues 620373, 449498 and 454036 (and probably there are ...


12

You can download the certificate manually with openssl and add it into your local trusted certificates: echo -n | openssl s_client -connect download.01.org:443 | \ sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | \ sudo tee '/usr/local/share/ca-certificates/download_01_org.crt' sudo update-ca-certificates


11

The easiest way is to import the certificate into a sample firefox-profile and then copy the cert8.db to the users you want equip with the certificate. First import the certificate by hand into the firefox profile of the sample-user. Then copy /home/${USER}/.mozilla/firefox/${randomalphanum}.default/cert8.db into the users firefox-profiles. That's it. ...


9

As alternative you can download the ssl certificate by hand. Afterwards pidgin starts without problems. To download the certificate you can use openssl command line utility. ~/.purple/certificates/x509/tls_peers$ openssl s_client -connect YOUR_SERVER:PORTNUMBER When the above command fails with "no peer certificate available" then maybe the server uses ...


7

Anyone can teach about Ubuntu and a certification is not required. Manuals for 11.10 can be found here. Particularly the Ubuntu desktop help will be useful to you if you want to cover the desktop (the other 2 are about server and installing).


7

To prevent the SSL error 61 when accessing remote sessions: Make Firefox's certificates accessible to Citrix, sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts Source: Citrix help page


7

Turns out it there's a bug with certificates in Pidgin 2.10.10 (libpurple 2.10.10): In version 2.10.10 it's no longer possible to connect to a XMPP server which uses a self signed SSL certificate. The error message is: The certificate for could not be validated. The certificate chain presented is invalid. The connection is possible if the ...


6

Given the extra information you've provided, it is probably easier for me to start another answer. It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of CN=Ubuntu, while the certificate being presented to the Windows box has a subject of CN=Production. So ...


6

They are NOT safe and that is why they are marked as Untrusted. These were bogus certificates. See this article on EFF: On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not ...


5

TL;DR For everything to work and not only your browser, you need to add that CA certificate to the system's trusted CA repository. In ubuntu: Go to /usr/share/ca-certificates/ Create a new folder, i.e. "sudo mkdir school" Copy the .crt file into the school folder Make sure the permissions are OK (755 for the folder, 644 for the file) Run "sudo update-ca-...


4

You could disable password-based login on the ssh server and remove the iptables rules. Nobody will then be able to brute-force a password-login because it's disabled, but trusted users with their key-pairs would be able to login from everywhere. To limit the usage of the keys, you can specify which hosts they can be used from with the from parameter in ...


4

The "snakeoil" certificate is automatically generated when the ssl-cert package is installed. It is a self signed certificate, so revoking it doesn't make much sense. You can easily generate a new one though: sudo make-ssl-cert generate-default-snakeoil --force-overwrite You will probably have to restart any service that was making use of that ...


4

Part One: With Firefox, back up the certificate as a .p12 file. In Firefox, click Edit > Preferences to display the Preferences dialog. On the Preferences dialog, click the Advanced button. On the Advanced form, click the the View Certificates button to display the Certificate Manager dialog. On the Certificate Manager dialog, click the Your ...


4

You can sign PDF files with gpg/seahorse. Learn more: https://help.ubuntu.com/community/GnuPrivacyGuardHowto You can for instance use OpenSignPDF, that can be download here: http://opensignature.sourceforge.net/english.php I hope this answers your question.


4

If you're fine with using the command line, this is easily done using gpg --gen-revoke. The revocation certificate is stored in revoke.asc (in your home directory if you do not change anything else) and you should replace mykey by your key id. gpg --output revoke.asc --gen-revoke mykey Remember to store it in a save place, for example by printing it to a ...


4

This is a known bug in wget 1.12. As you are running an unsupported version of ubuntu the best course of action would be to upgrade to a supported version . wget 1.14 is the latest version in ubuntu and has fixed this bug.


4

Why must Ubuntu respect Indian law? Mozilla handles the certificate vetting for most Linux distributions (and most applications - even Chrome uses's Mozilla's NSS AFAIK) and they're bundled into ca-certificates along with some Debian infrastructure certificates. Mozilla is the party that the Indian government has to prove their value to. They've been in ...


4

You removed all certificates yourself when you ran sudo rm -rf /etc/ssl/certs/*. That broke your system. One thing you can do to fix this is to reinstall the package they come from: sudo apt-get install --reinstall ca-certificates This should be relatively safe. If that doesn't work, you may need to purge the package out and reinstall it but don't attempt ...


4

Extensions .crt, .pem and .cer are interchangeable, just change the file name extension, they have the same form. Try this: $ sudo cp mycert.cer /usr/share/ca-certificates/mycert.pem $ sudo dpkg-reconfigure ca-certificates $ sudo update-ca-certificates $ git config --global http.sslCAInfo /usr/share/ca-certificates/mycert.pem


3

It may be too late to help you, but I'm posting this here for future reference. I had the same problem. I ended up just typing the file name in the address at the top and it worked. Took me an hour to figure it out though.


3

1 . No 2.Yes you can use. But you should obtain permission from canonical 3.AFAIK no 4.I don't know about such sites, But you are already doing it here(askubuntu.com) 5.There is no need of permissions to teach ubuntu


3

Ok, found the answer after much poking around and searching. apt-get install ca-certificates Probably apt-get install ssl-cert is needed too if you haven't already installed it.


3

OK,after a lot of tries I understand the problem and find the solution. Just use this(in hebrew) page in the Internet Rimon ISP site. פשוט תשתמש בקישור הזה באתר של אינטרנט רימון. Explanation my ISP(INTERNET RIMON -only in IL) is a special one. It filtering violence, porn and bad content. But in secure pages they have a problem. they can't look in it... ...


3

After researching and working on this over the last couple days I got it to work, and the answer ended up being rather simple. I needed to set capath=/etc/ssl/certs/in my .curlrc file. This got curl working on the command line. To further get curl to work in R (where I first encountered the problem) I also needed to have cacert=/etc/ssl/certs/ca-...


2

Have the (root / CA) certificate available on a web server, local to your network if you like. Browse to it with Firefox. Open the cert and tell Firefox to add it as an exception. Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers. Enjoy! Update: It will be necessary to ...



Only top voted, non community-wiki answers of a minimum length are eligible