I don't appear to have any SSL certs installed on my machine and it is causing issues with wget and Faraday called within Rails.

When I run openssl version -a I am told my OPENSSLDIR is "/usr/lib/ssl".

When I look inside /usr/lib/ssl/certs it is empty.

When I run sudo apt-get install ca-certificates I am told that ca-certificates is already at the newest version and when I run sudo update-ca-certificates I get the following output;

Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
There was a problem saving the new Java keystore. Message:
  /etc/ssl/certs/java/cacerts (No such file or directory)
E: /etc/ca-certificates/update.d/jks-keystore exited with code 1.

I have two questions.

1) Am I barking up the wrong tree? Is it normal for /usr/lib/ssl/certs to be empty

2) What is the next step I should take?


When I run dpkg -L ca-certificates (Thanks to this question) I can see plenty of mozilla certs stored in /usr/share/ca-certificates/mozilla/

  • 1
    What happens when you create the folder /etc/ssl/certs/java/ and re-run the update-ca-certificates command?
    – psx
    Commented Feb 17, 2016 at 13:08
  • @psynnott good thinking, that seemed to allow it to populate! If you want to add this as an answer I can mark as the accepted solution
    – Toby
    Commented Feb 17, 2016 at 13:13
  • I don't pretend to fully understand the purpose of each of the folders you mentioned, I just took a stab at what the command was trying to do :)
    – psx
    Commented Feb 17, 2016 at 13:24

1 Answer 1


I suspect that if you create the folder /etc/ssl/certs/java/, it will allow the sudo update-ca-certificates to complete. It looks like it just isn't able to create the file because it's parent folder doesn't exist.

  • Some observations about this in 16.04.06 LTS (vintage of the OP): openssl reports "/usr/lib/ssl", which is where 'openssl.cnf' lives, but "/usr/lib/ssl/certs" is just a symbolic link to "etc/ssl/certs". On top of that, all of the many certs (pem, crt, etc) are symbolic links to "/usr/share/ca-certificates/mozilla". O.o Yet the issue here was a java folder. It seems the openssl root of trust is some mash-up of java and mozilla trust models. Commented Sep 16, 2020 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .