Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
2 years, 2 months ago
I have an ansible play that calls a script. The script copies .crt files for my private key infrastructure in to /usr/share/ca-certificates/my.domain.tld
Then the script calls:
sudo dpkg-reconfigure ca-certificates
The dpkg-reconfigure call causes a curses interface to appear asking me to specifically select and enable the certs I want to enable. I need to find a way for this to run non-interactively. There must be solutions, but I've searched for a while and found nothing that works so far.
Help would be fantastic/wonderful/awesome, please!
Mar 16, 2021 at 5:23
I found lots of cool stuff around altering the debconf database to have the questions in the UI preseeded, but it didn't actually change anything for me.
Ultimately, what got it working for me was to figure out what
dpkg-reconfigure is likely doing and then just do it myself (via script). It wasn't actually that much.
Copy your .crt certs to
Symlink these certs you added to
/usr/share/ca-certificates/your.domain.tld in to
/etc/ca-certificates.conf contain a line for your certs like:
Notice that those lines do NOT start with
!, that would deselect these certs. For this step, I used:
sed -i ... to make sure these lines had no leading
bash conditional to check if these lines even existed, e.g.:
if [ ! grep -q "your.domain.tld/issuing_ca.crt" /etc/ca-certificates.conf ] ; then
if the lines didn't exist, I added them with:
cat [filename] >> /etc/ca-certificates.conf
(This combines all the certs in
/etc/ssl/certs to make a single
ca-certificates.crt that applications use.)
Mar 18, 2021 at 16:46
Based on past questions you should be able to copy them to /usr/local/share/ca-certificates/(NewFolder) and then
sudo update-ca-certificates in order to make them useable to your applications
May 18, 2021 at 18:19
Creating a folder in /usr/local/share/ca-certificates and copying my ca cert to it worked for me (Thanks Roy Abernathy) Here is the relevant part of my playbook:
- name: Create directory mycert in /usr/local/share/ca-certificates/
- name: Copy certificate to /usr/local/share/ca-certificates/mycert
- name: Update CA certificate trust
shell: /bin/bash -c "update-ca-certificates"
Hope this helps someone.
Oct 5, 2021 at 23:53
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only