I don't appear to have any SSL certs installed on my machine and it is causing issues with wget and Faraday called within Rails.

When I run openssl version -a I am told my OPENSSLDIR is "/usr/lib/ssl".

When I look inside /usr/lib/ssl/certs it is empty.

When I run sudo apt-get install ca-certificates I am told that ca-certificates is already at the newest version and when I run sudo update-ca-certificates I get the following output;

Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
There was a problem saving the new Java keystore. Message:
  /etc/ssl/certs/java/cacerts (No such file or directory)
E: /etc/ca-certificates/update.d/jks-keystore exited with code 1.

I have two questions.

1) Am I barking up the wrong tree? Is it normal for /usr/lib/ssl/certs to be empty

2) What is the next step I should take?


When I run dpkg -L ca-certificates (Thanks to this question) I can see plenty of mozilla certs stored in /usr/share/ca-certificates/mozilla/

  • 1
    What happens when you create the folder /etc/ssl/certs/java/ and re-run the update-ca-certificates command?
    – psx
    Feb 17, 2016 at 13:08
  • @psynnott good thinking, that seemed to allow it to populate! If you want to add this as an answer I can mark as the accepted solution
    – Toby
    Feb 17, 2016 at 13:13
  • I don't pretend to fully understand the purpose of each of the folders you mentioned, I just took a stab at what the command was trying to do :)
    – psx
    Feb 17, 2016 at 13:24

1 Answer 1


I suspect that if you create the folder /etc/ssl/certs/java/, it will allow the sudo update-ca-certificates to complete. It looks like it just isn't able to create the file because it's parent folder doesn't exist.

  • Some observations about this in 16.04.06 LTS (vintage of the OP): openssl reports "/usr/lib/ssl", which is where 'openssl.cnf' lives, but "/usr/lib/ssl/certs" is just a symbolic link to "etc/ssl/certs". On top of that, all of the many certs (pem, crt, etc) are symbolic links to "/usr/share/ca-certificates/mozilla". O.o Yet the issue here was a java folder. It seems the openssl root of trust is some mash-up of java and mozilla trust models. Sep 16, 2020 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.