User:Grawity/Adding a trusted CA certificate

From ArchWiki
Revision as of 12:21, 4 April 2015 by Grawity (talk | contribs)
Jump to navigation Jump to search
Warning: Do not put files directly in /etc/ssl/certs. It is not enough, as Java & GnuTLS won't see any certificates installed this way.

Personal – NSS (Chromium, Firefox)

Chromium, Firefox, SeaMonkey use NSS for retrieving trusted CAs. They should pick up any certificates used system-wide, but you can install certificates into your own browser profile as well. Use certutil for this:

certutil -d database -A -i myCA.cert -n "Honest Achmed's CA" -t C,,

Chromium uses the "shared" database at -d "sql:$HOME/.pki/nssdb".

For Firefox and SeaMonkey, specify the browser's own profile directory (e.g. -d ~/.mozilla/firefox/ov6jazas.default).

System-wide – update-ca-trust (Arch, Fedora)

Currently Arch Linux uses the Fedora-style ca-certificates scripts.

  1. Copy the certificate to the /etc/ca-certificates/trust-source/anchors directory.
  2. Run update-ca-trust as root.

For more information, see the update-ca-trust(8) manual page.

System-wide – update-ca-certificates (Debian, Ubuntu)

Previously, Arch Linux used the Debian-style ca-certificates scripts. These instructions therefore still work for Debian and Ubuntu.

The Debian-style update-ca-certificates requires certificates in PEM format (the text format with BEGIN CERTIFICATE headers). If you have a file in binary (DER) format, use openssl x509 to convert it:

openssl x509 -inform DER < myCA.crt > myCA_pem.crt

To install:

  1. Copy the certificate to the /usr/local/share/ca-certificates directory (mkdir if needed). The file name must end with .crt.
  2. Run update-ca-certificates as root.

For more information, see the update-ca-certificates(8) manual page.