Maybe this is a duplicate, but i cannot find the answer. Windows CA authorities provide their root certificates in several forms: The certificate by itself and full chain, each can be downloaded in 2 formats: DER and BASE64. There are tens of articles about certificate formats on the internet but none about what format do I need when I want to import the CA into linux store using update-ca-certificates.

The issue is so complicated because not only that there are multiple formats, there are also multiple extensions. In the common case they would be p7b, pem, pfx, cer and crt and who knows what else. I don't give a damn about understanding all the various "my toy, your toy" psychology of evolution of these formats or their intricacies.

Can someone simply state:

  1. What format of CA certificate does update-ca-certificates requires?
  2. What extension does update-ca-certificates requires?
  3. Which format from Windows CA should I use: DER or Base64 for to get the certificate and how to convert it to the format understood by update-ca-certificates?
  4. Should I download the whole chain or just the root CA certificate?

format = Pem file

To convert use :

openssl x509 -inform DER -in yourdownloaded.crt -out outcert.pem -text


sudo mkdir /usr/local/share/ca-certificates/extra
sudo cp root.cert.pem /usr/local/share/ca-
sudo update-ca-certificates

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.