How to noninteractively add Certificate Authority (CA) ssl certificates from script

Question

I have an ansible play that calls a script. The script copies .crt files for my private key infrastructure in to /usr/share/ca-certificates/my.domain.tld

Then the script calls:

sudo update-ca-certificates
sudo dpkg-reconfigure ca-certificates 

The dpkg-reconfigure call causes a curses interface to appear asking me to specifically select and enable the certs I want to enable. I need to find a way for this to run non-interactively. There must be solutions, but I've searched for a while and found nothing that works so far.

Help would be fantastic/wonderful/awesome, please!

Answer 1

I found lots of cool stuff around altering the debconf database to have the questions in the UI preseeded, but it didn't actually change anything for me.

Ultimately, what got it working for me was to figure out what dpkg-reconfigure is likely doing and then just do it myself (via script). It wasn't actually that much.

1. Copy your .crt certs to /usr/share/ca-certificates/your.domain.tld

2. Symlink these certs you added to /usr/share/ca-certificates/your.domain.tld in to /etc/ssl/certificates/

3. Make sure /etc/ca-certificates.conf contain a line for your certs like:

   your.domain.tld/issuing_ca.crt
   your.domain.tld/root_ca.crt
   

   Notice that those lines do NOT start with !, that would deselect these certs. For this step, I used:

   • sed -i ... to make sure these lines had no leading !

   • bash conditional to check if these lines even existed, e.g.:

     if [ ! grep -q "your.domain.tld/issuing_ca.crt" /etc/ca-certificates.conf ] ; then
     

   • if the lines didn't exist, I added them with:

     cat [filename] >> /etc/ca-certificates.conf
     

4. Run sudo update-ca-certificates.

   (This combines all the certs in /etc/ssl/certs to make a single ca-certificates.crt that applications use.)

Answer 2

Based on past questions you should be able to copy them to /usr/local/share/ca-certificates/(NewFolder) and then sudo update-ca-certificates in order to make them useable to your applications

Answer 3

Creating a folder in /usr/local/share/ca-certificates and copying my ca cert to it worked for me (Thanks Roy Abernathy) Here is the relevant part of my playbook:

- name: Create directory mycert in /usr/local/share/ca-certificates/
  file:
    path: //usr/local/share/ca-certificates/mycert
    state: directory

- name: Copy certificate to /usr/local/share/ca-certificates/mycert
  copy:
    src: certificate.cer
    dest: /usr/local/share/ca-certificates/dcpud/certificate.crt
    owner: root
    group: root
    mode: 0644

- name: Update CA certificate trust
  shell: /bin/bash -c "update-ca-certificates"

Hope this helps someone.