Difference between revisions of "User:Grawity/Adding a trusted CA certificate"

From ArchWiki
Jump to navigation Jump to search
(expand on p11-kit)
Line 13: Line 13:
 
== System-wide – update-ca-trust (Arch, Fedora) ==
 
== System-wide – update-ca-trust (Arch, Fedora) ==
  
Currently Arch Linux uses the Fedora-style ca-certificates scripts.
+
Currently Arch Linux uses the Fedora-style p11-kit.
 +
 
 +
# Run {{ic|trust anchor --store ''myCA''.crt}} as root.
 +
 
 +
The certificate will be written to {{ic|/etc/ca-certificates/trust-source/''myCA''.p11-kit}} and the "legacy" directorues automatically updated.
 +
 
 +
If you get "no configured writable location" or a similar error, import the CA manually:
  
 
# Copy the certificate to the {{ic|/etc/ca-certificates/trust-source/anchors}} directory.
 
# Copy the certificate to the {{ic|/etc/ca-certificates/trust-source/anchors}} directory.

Revision as of 18:23, 23 September 2015

Warning: Do not put files directly in /etc/ssl/certs. It is not enough, as Java & GnuTLS won't see any certificates installed this way.

Personal – NSS (Chromium, Firefox)

Chromium, Firefox, SeaMonkey use NSS for retrieving trusted CAs. They should pick up any certificates used system-wide, but you can install certificates into your own browser profile as well. Use certutil for this:

certutil -d database -A -i myCA.cert -n "Honest Achmed's CA" -t C,,

Chromium uses the "shared" database at -d "sql:$HOME/.pki/nssdb".

For Firefox and SeaMonkey, specify the browser's own profile directory (e.g. -d ~/.mozilla/firefox/ov6jazas.default).

System-wide – update-ca-trust (Arch, Fedora)

Currently Arch Linux uses the Fedora-style p11-kit.

  1. Run trust anchor --store myCA.crt as root.

The certificate will be written to /etc/ca-certificates/trust-source/myCA.p11-kit and the "legacy" directorues automatically updated.

If you get "no configured writable location" or a similar error, import the CA manually:

  1. Copy the certificate to the /etc/ca-certificates/trust-source/anchors directory.
  2. Run update-ca-trust as root.

For more information, see the update-ca-trust(8) manual page.

System-wide – update-ca-certificates (Debian, Ubuntu)

Previously, Arch Linux used the Debian-style ca-certificates scripts. These instructions therefore still work for Debian and Ubuntu.

The Debian-style update-ca-certificates requires certificates in PEM format (the text format with BEGIN CERTIFICATE headers). If you have a file in binary (DER) format, use openssl x509 to convert it:

openssl x509 -inform DER < myCA.crt > myCA_pem.crt

To install:

  1. Copy the certificate to the /usr/local/share/ca-certificates directory (mkdir if needed). The file name must end with .crt.
  2. Run update-ca-certificates as root.

For more information, see the update-ca-certificates(8) manual page.