2

On Ubuntu 14.04.2 LTS, I'm attempting to add an intermediate cert to the system's store of trusted CA certs. I installed the .crt file in /usr/local/share/ca-certificates, then ran update-ca-certificates. The symlink was created from /etc/ssl/certs to the .crt. However, the cert was not included into /etc/ssl/certs/ca-certificates.crt.

Man page for update-ca-certificates says:

update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates certificates.crt, a concatenated single-file list of certificates.

It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that should be trusted. Lines that begin with "#" are comment lines and thus ignored. Lines that begin with "!" are deselected, causing the deactivation of the CA certificate in question.

Furthermore all certificates found below /usr/local/share/ca- certificates are also included as implicitly trusted.

I was able to get the cert into ca-certificates.crt by editing the /etc/ca-certificates.conf file and giving the path to the cert, then running update-ca-certificates. So my question is: is the man page wrong and does the /usr/local/share/ca-certificates method not work? Or did I miss a trick?

Thanks!

0

Works for me. Did you install the certificate in /usr/local/share/ca-certificates with suffix .crt? This is the part in the update-ca-certificates script, which adds certs from LOCALCERTSDIR:

if [ -d "$LOCALCERTSDIR" ]
then
  find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt
  do
    add "$crt"
  done
fi

You might want to check if LOCALCERTSDIR is set to the /usr/local/share/ca-certificates directory. After running update-ca-certificates I got a link from /etc/ssl/certs/xyz.pem to $LOCALCERTSDIR/xyz.crt and its content has been added to the /etc/ssl/certs/ca-certificates.crt. Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.