Can anyone point me to a good tutorial on installing a root certificate on ubuntu 10 or 11?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/newdomain.org and place the .crt in that directory. Beyond that I'm not sure how to proceed.

migrated from stackoverflow.com Oct 28 '11 at 18:03

This question came from our site for professional and enthusiast programmers.

up vote 225 down vote accepted

Installing a root/CA Certificate

Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu:

  1. Create a directory for extra CA certificates in /usr/share/ca-certificates:

    sudo mkdir /usr/share/ca-certificates/extra
    
  2. Copy the CA .crt file to this directory:

    sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt
    
  3. Let Ubuntu add the .crt file's path relative to /usr/share/ca-certificates to /etc/ca-certificates.conf:

    sudo dpkg-reconfigure ca-certificates
    

    To do this non-interactively, run:

    sudo update-ca-certificates
    

In case of a .pem file on Ubuntu, it must first be converted to a .crt file:

openssl x509 -in foo.pem -inform PEM -out foo.crt
  • 42
    How about using /usr/local/share/ca-certificates (local!) instead of using a system package management managed directoy? – gertvdijk Mar 31 '14 at 13:03
  • 2
    Could add the following step to ensure the cert is in pem format? openssl x509 -inform DER -outform PEM -in foo.crt -out foo.pem – steakunderscore Feb 1 '15 at 20:53
  • 6
    Note that Firefox (and maybe some other software) don't use the system-wide certificates, but has its own certificate store: askubuntu.com/a/248326/79344. – Amir Ali Akbari Jun 6 '15 at 17:51
  • 9
    Note that the file must be in PEM format and have ".crt" extension. – Anton Jun 5 '16 at 7:07
  • 2
    The command openssl x509 -in foo.pem -inform PEM -out foo.crt copies a PEM file to a PEM file. This can be done easier by renaming. – Marian Jul 26 '17 at 17:22

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem
done.
done.

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

This procedure works also in newer versions: manuals.

  • 1
    this seems not to work in trusty tahr 14.04 – mcantsin Mar 28 '14 at 19:21
  • 21
    Please note that, unlike adding to /usr/share/ca-certificates, this seems to only work if they're directly in /usr/local/share/ca-certificates and not a subdirectory. +1 for using local folder instead of system folder! – Toby J Apr 8 '14 at 5:11
  • 2
    This is documented in README.Debian. – pevik Aug 24 '16 at 9:32
  • 1
    @Sparky1, This should be the accepted answer. – Drew Chapin Feb 17 '17 at 12:46
  • 1
    @FranklinYu thanks :) Debian moved from Alioth to Salsa, this would work as well: salsa.debian.org/debian/ca-certificates/raw/master/debian/…, but sources.debian.org is better. – pevik Sep 12 at 12:47

Install a Certificate Authority on Ubuntu

I have tested this on Ubuntu 14.04.

Here is my solution, I looked and looked for a long time trying to figure out how to get this to work.

  1. Extract the .cer from browser. I used IE 11.
    • Settings -> Internet Options -> Intermediate Certificate Authorities
    • Select The Certificate Authority You Want To Export (certutil -config - -ping will show you the ones you are using if you are behind a corporate proxy)
    • Export -> Select The Format You Want To Use: DER Encoded .cer
  2. Get the .cer files to Ubuntu somehow
  3. Convert to .crt openssl x509 -inform DER -in certificate.cer -out certificate.crt
  4. Make extra directory sudo mkdir /usr/share/ca-certificates/extra
  5. Copy certificates over sudo cp certificate.crt /usr/share/ca-certificates/extra/certificate.crt
  6. sudo update-ca-certificates
  7. If not, then you have to do what I did, go to sudo nano /etc/ca-certificates.conf
  8. Scroll down and find your .cer and remove the ! from in front of the file name (update-ca-certificates doc) - if you don't find your certificate run dpkg-reconfigure ca-certificates
  9. Run sudo update-ca-certificates
  10. You may need to individually trust the CAs from Firefox, Chrome, etc.. , I needed it to work with Docker so after these steps it worked with Docker.
  • 1
    does this work in 16.04? – endolith Oct 14 '16 at 15:01
  • @endolith worked for me in 16.04. – Shubham Aggarwal Jul 25 '17 at 6:19

Have the (root / CA) certificate available on a web server, local to your network if you like.

  • Browse to it with Firefox.
  • Open the cert and tell Firefox to add it as an exception.
  • Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
  • Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

  • 5
    hasn't firefox its own certificate container? If one would add a certificate this way, just firefox would be able to use it, wouldn't it? – Aiyion.Prime Mar 23 '15 at 16:47
  • That does not work at all, you still have to add it to the global cert container of the OS, otherwise it only will be in the Firefox container. – arc_lupus Apr 4 '16 at 7:25

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

  • Should have read more closely... It looks like that's not for root certificates. That page that I linked to though has information about root certificates that might be useful. – jat255 Oct 28 '11 at 18:06
  • 1
    I don't have a public key and a private key, I just have a .crt so unfortunately those instruction don't seem to apply. – Sparky1 Oct 28 '11 at 19:01

To add a Root CA certificate in FireFox is now-a-days very easy. Just open preferences, go to "Privacy & Security", scroll down to "Certificates" and click "View Certificates...". Here you can click "Import Certificate". Point to your root CA (.pem) and OK. That's all folks.

Other answers didn't work for me with Ubuntu 18.04. I passed the certificate cert in to /etc/ssl/certs/ca-certificates.crt using the following command:

cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificate.crt 
New contributor
Jasmit Tarang is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.