So, I have created my own little CA for my own purposes (inside my network, etc) and I know that the setup works (I can directly import the key into applications, and they connect to the server using the key fine).

But! When I tried to import the CA Certificate so that all applications can use it, they don't (firefox and chromium)

I have

  • Placed the cacert.pem in /etc/ssl/certs and ran update-ca-certificates and dpkg-reconfigure ca-certificates

  • Directly placed the cert inside the ca-certificates.crt file (As it wasn't being placed in there inspite of the previous commands)

I'm stumped.


Ubuntu Desktop, 12.04 x64

cat cacert.pem


openssl x509 -in cacert.pem -noout -text

        Version: 3 (0x2)
        Serial Number: 1xxxxxxxxxxxxxxxxxx3 (0xXXXXXXXXXXXXXX9)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AU, ST=Western Australia, L=xx, O=xx, OU=Webmasters, CN=haven/emailAddress=xx
            Not Before: Dec  8 11:47:37 2012 GMT
            Not After : Dec  6 11:47:37 2022 GMT
        Subject: C=AU, ST=Western Australia, L=xx, O=xx, OU=Webmasters, CN=haven/emailAddress=xx
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
            X509v3 Authority Key Identifier: 

            X509v3 Basic Constraints: 
    Signature Algorithm: sha1WithRSAEncryption

Thanks in advance!


1 Answer 1


Try placing your certificates in /usr/share/ca-certificates

Then modify /etc/ca-certificates.conf to include a reference to your new certificate.

Then run



So done some more digging on this. It seems that firefox does not honour the /etc/ssl/certs database. Found this - its quite old but I believe it still to be the case.

As far as I can tell each user has their own cert database held in the cert8.db file in their profile directory. This can be updated using firefox directly (is their a reason for wanting to do this command line?) - but obviously each individual user will have to do this. Alternatively there is a command line way of doing this see here and here. You could build a script to go through each user profile directory to do this (yuk!). Doesn't seem to be a "nice" way to do this for all users as far as I can tell.

  • No go, not showing in firefox's CA list. (did restart firefox)
    – NRoach44
    Dec 8, 2012 at 13:58
  • However, while running an apt-get update for something else I saw that it wasn't complaining about my server's certificate being off... EDIT: Nope, chrome and FF not picking it up...
    – NRoach44
    Dec 8, 2012 at 14:01
  • Okay, thanks. The guide I was following was giving me the impression that there was a global location for CA certificates to be stored. Thanks anyways!
    – NRoach44
    Dec 9, 2012 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.