358

Can anyone point me to a good tutorial on installing a root certificate on Ubuntu?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/newdomain.org and place the .crt in that directory. Beyond that I'm not sure how to proceed.

Improve this question
4

9 Answers 9

Reset to default
477

Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu:

  1. Create a directory for extra CA certificates in /usr/local/share/ca-certificates:

    sudo mkdir /usr/local/share/ca-certificates/extra

  2. Copy the CA .crt file to this directory:

    sudo cp foo.crt /usr/local/share/ca-certificates/extra/foo.crt

  3. Let Ubuntu add the .crt file's path relative to /usr/local/share/ca-certificates to /etc/ca-certificates.conf:

    sudo dpkg-reconfigure ca-certificates

    To do this non-interactively, run:

    sudo update-ca-certificates

In case of a .pem file on Ubuntu, it must first be converted to a .crt file:

openssl x509 -in foo.pem -inform PEM -out foo.crt

Or a .cer file can be converted to a .crt file:

openssl x509 -inform DER -in foo.cer -out foo.crt
Improve this answer
18
  • 80
    How about using /usr/local/share/ca-certificates (local!) instead of using a system package management managed directoy?
    – gertvdijk
    Mar 31, 2014 at 13:03
  • 14
    Note that Firefox (and maybe some other software) don't use the system-wide certificates, but has its own certificate store: askubuntu.com/a/248326/79344.
    – Amir Ali Akbari
    Jun 6, 2015 at 17:51
  • 27
    Note that the file must be in PEM format and have ".crt" extension.
    – Anton
    Jun 5, 2016 at 7:07
  • 27
    The command openssl x509 -in foo.pem -inform PEM -out foo.crt copies a PEM file to a PEM file. This can be done easier by renaming.
    – Marian
    Jul 26, 2017 at 17:22
  • 7
    PEM and crt are two unrelated things. PEM is an encoding (contrast with .DER) while crt is just a naming convention to indicate the contents (contrast with .key)
    – Gerald
    Sep 6, 2018 at 10:09
263

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem
done.
done.

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

This procedure works also in newer versions: manuals.

Improve this answer
13
  • 1
    this seems not to work in trusty tahr 14.04
    – mcantsin
    Mar 28, 2014 at 19:21
  • 33
    Please note that, unlike adding to /usr/share/ca-certificates, this seems to only work if they're directly in /usr/local/share/ca-certificates and not a subdirectory. +1 for using local folder instead of system folder!
    – Tobias J
    Apr 8, 2014 at 5:11
  • 2
    This is documented in README.Debian.
    – pevik
    Aug 24, 2016 at 9:32
  • 1
    I had to do openssl x509 -outform pem -in in_file.pem -out out_file.crt. Got complaints about "multiple certificates" in the CRT file if I did -outform der.
    – Dave Hein
    Dec 29, 2016 at 20:50
  • 2
    Thanks! It works in 18.04 as well, the first answer with copying the crt file /usr/share/ca-certificates/extra doesn't seem to work however.
    – QPTR
    Jan 17, 2019 at 16:25
23

Clarification between update-ca-certificates and dpkg-reconfigure ca-certificates and why one works and the other does not!!

  • update-ca-certificates or sudo update-ca-certificates will only work if /etc/ca-certificates.conf has been updated.

  • /etc/ca-certificate.conf is only updated once you ran dpkg-reconfigure ca-certificates which updates the certificate names to be imported into /etc/ca-certificates.conf.

This is stated in the header of the /etc/ca-certificates.conf file:

# This file lists certificates that you wish to use or to ignore to be
# installed in /etc/ssl/certs.
# update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
#
# This is autogenerated by dpkg-reconfigure ca-certificates.  <=======
# Certificates should be installed under /usr/share/ca-certificates
# and files with extension '.crt' is recognized as available certs.
#
# line begins with # is comment.
# line begins with ! is certificate filename to be deselected.
#
mozilla/ACCVRAIZ1.crt
mozilla/AC_RAIZ_FNMT-RCM.crt
mozilla/Actalis_Authentication_Root_CA.crt
mozilla/AddTrust_External_Root.crt
...

As you can see, the format in /etc/ca-certificates.conf is <folder name>/<.crt name>

So in order to use update-ca-certificates or sudo update-ca-certificates you could do the following to import a .crt:

  1. Create a directory for extra CA certificates in /usr/share/ca-certificates:

     sudo mkdir /usr/share/ca-certificates/extra

  2. Copy the .crt file to this directory:

     sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt

  3. Append a line to /etc/ca-certificates.conf using <folder name>/<.crt name>:

     echo "extra/foo.crt" | sudo tee -a /etc/ca-certificates.conf

  4. Update certs non-interactively with sudo update-ca-certificates

     $ sudo update-ca-certificates
 ...
 Updating certificates in /etc/ssl/certs...
 1 added, 0 removed; done.
Improve this answer
3
  • For my case with Ubuntu 16.04, No output: locate foo.crt and the output : sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt is: cp: cannot stat 'foo.crt': No such file or directory. Sadly, I first removed ca-certificates. How I can fix it, please?
    – REDHWAN
    Jun 7, 2020 at 3:28
  • On Ubuntu 20.04 LTS, there is no need to use the interactive dpkg-reconfigure ca-certificates. update-ca-certificates adds a certificate from a newly created folder like /usr/local/share/ca-certificates/extra successfully.
    – stackprotector
    Mar 3, 2022 at 10:51
  • Docs: ubuntu.com/server/docs/security-trust-store
    – stackprotector
    Mar 3, 2022 at 10:55
14

Install a Certificate Authority on Ubuntu

I have tested this on Ubuntu 14.04.

Here is my solution, I looked and looked for a long time trying to figure out how to get this to work.

  1. Extract the .cer from browser. I used IE 11.
    • Settings -> Internet Options -> Intermediate Certificate Authorities
    • Select The Certificate Authority You Want To Export (certutil -config - -ping will show you the ones you are using if you are behind a corporate proxy)
    • Export -> Select The Format You Want To Use: DER Encoded .cer
  2. Get the .cer files to Ubuntu somehow
  3. Convert to .crt openssl x509 -inform DER -in certificate.cer -out certificate.crt
  4. Make extra directory sudo mkdir /usr/share/ca-certificates/extra
  5. Copy certificates over sudo cp certificate.crt /usr/share/ca-certificates/extra/certificate.crt
  6. sudo update-ca-certificates
  7. If not, then you have to do what I did, go to sudo nano /etc/ca-certificates.conf
  8. Scroll down and find your .cer and remove the ! from in front of the file name (update-ca-certificates doc) - if you don't find your certificate run dpkg-reconfigure ca-certificates
  9. Run sudo update-ca-certificates
  10. You may need to individually trust the CAs from Firefox, Chrome, etc.. , I needed it to work with Docker so after these steps it worked with Docker.
Improve this answer
3
  • 1
    does this work in 16.04?
    – endolith
    Oct 14, 2016 at 15:01
  • @endolith worked for me in 16.04.
    – Shubham
    Jul 25, 2017 at 6:19
  • thanks for point no 10
    – Sai Teja Pakalapati
    Jun 1, 2020 at 11:08
4

Other answers didn't work for me with Ubuntu 18.04. Append the certificate cert to /etc/ssl/certs/ca-certificates.crt using the following command:

cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificates.crt
Improve this answer
5
  • 1
    2 hours of messing about with import commands before I found this. Perfect!
    – beirtipol
    Feb 14, 2019 at 16:07
  • The command is wrong, the final s is missing: cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificates.crt . Thanks for this solution.
    – SommerEngineering
    Apr 15, 2019 at 14:31
  • 4
    Note: This is the temporary solution, as the added certificate is going to be removed after running update-ca-certificates.
    – kenorb
    May 17, 2019 at 10:49
  • what is removed? I haven't seen my certificate removed.
    – Someone Special
    Mar 17, 2021 at 9:24
  • I get permission denied on this, even with sudo at the beginning: sudo cat DigiCertGlobalRootCA.crt >> /etc/ssl/certs/ca-certificates.crt bash: /etc/ssl/certs/ca-certificates.crt: Permission denied
    – Alex Mi
    Feb 1 at 19:33
3

Have the (root / CA) certificate available on a web server, local to your network if you like.

  • Browse to it with Firefox.
  • Open the cert and tell Firefox to add it as an exception.
  • Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
  • Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

Improve this answer
2
  • 6
    hasn't firefox its own certificate container? If one would add a certificate this way, just firefox would be able to use it, wouldn't it?
    – Aiyion.Prime
    Mar 23, 2015 at 16:47
  • That does not work at all, you still have to add it to the global cert container of the OS, otherwise it only will be in the Firefox container.
    – arc_lupus
    Apr 4, 2016 at 7:25
1

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

Improve this answer
2
  • Should have read more closely... It looks like that's not for root certificates. That page that I linked to though has information about root certificates that might be useful.
    – jat255
    Oct 28, 2011 at 18:06
  • 1
    I don't have a public key and a private key, I just have a .crt so unfortunately those instruction don't seem to apply.
    – Sparky1
    Oct 28, 2011 at 19:01
1

To add a Root CA certificate in FireFox is now-a-days very easy. Just open preferences, go to "Privacy & Security", scroll down to "Certificates" and click "View Certificates...". Here you can click "Import Certificate". Point to your root CA (.pem) and OK. That's all folks.

Improve this answer
1

Here are the simple steps:

  1. Install CA certificates to allow SSL-based applications to check for the authenticity of SSL connections:

    sudo apt-get install ca-certificates

  2. Copy certificate file (crt or .cer) into /usr/local/share/ca-certificates/ folder, e.g.:

    sudo cp file.crt /usr/local/share/ca-certificates/

    For PEM file, see: Convert .pem to .crt and .key.

    Optionally, if using Charles proxy, this command can work:

    curl -L chls.pro/ssl | sudo tee /usr/local/share/ca-certificates/charles.crt

  3. Update certificates:

    sudo update-ca-certificates

    The command will update /etc/ssl/certs directory to hold SSL certificates and generates ca-certificates.crt file (a concatenated single-file list of certificates).

    Note: Don't add certificates manually (as suggested here), as they are not persistent and going to be removed.

Note: If you're running as root, you can drop the sudo from the above commands.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.