I am running local sites via Nginx with self-signed HTTPS certificates. However, in GNOME Web (previously known as Epiphany) I still get a security warning because there is no certificate authority for the self-signed certificates.

What is the simplest way I can get Web (and Firefox) to recognise a local CA for these local certificates?


I usually go with easy-rsa whenever I need a local CA of my own.

sudo apt-get install easy-rsa
make-cadir myca
cd myca
$editor vars
./pkitool --help

For system/cli tools such as curl, git, etc to trust your newly generated ca.crt copy it to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates. See also /usr/share/doc/ca-certificates/README.Debian.

Firefox maintains its own ca-store, local to every user's Firefox profile. You can manually import your ca.crt under Firefox's advanced settings.


Generate Certificate

OpenSSL (preinstalled) comes with a perl script for creating a local CA: /usr/lib/ssl/misc/CA.pl Docs: https://www.openssl.org/docs/man1.1.0/apps/CA.pl.html

So you can simply create a simple CA with the ./CA.pl -newca command. You might want to edit the script, to have the settings fit your needs.

Then you can easily create requests (./CA.pl -newreq) and sing them (CA.pl -sign)

Install CA Certificate

If you have a graphical interface, you can just install the certificate by opening it in the file manager and installing it. Firefox doesn't use the system trust store though and it has to be added there manually. To install it for FireFox go to about:preferences#advanced select certificates > View Certificates > Autorities > Import

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.