Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I add self-signed certificates to e.g: Google Chrome under Linux (from the command line)? Thank you!

share|improve this question
    
You should be able to use the certutil utility to do this (it's included in Debian/Ubuntu's libnss3-tools package and should be in a similar package in other distros). Unfortunately, I can't seem to get it to work on either Chrome or Firefox's NSS databases on my machine. –  Patches May 17 '11 at 0:28
add comment

1 Answer

up vote 0 down vote accepted

According to LinuxCertManagement:

For example, to trust a root CA certificate for issuing SSL server certificates, use

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <nickname> -i <filename>

Note: to trust a self-signed server certificate, we should use

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <nickname> -i <filename>

Unfortunately that doesn't work because of NSS bug 531160. To work around the NSS bug, you have to trust it as a CA using the "C,," trust flags.

For Firefox, change the -d argument to Firefox profile path, without sql:.

share|improve this answer
    
So because of the bug it's really insecure to "C,," a self-signed certificate on XY website? –  LanceBaynes May 17 '11 at 10:59
    
@LanceBaynes: All X.509 certificates have a "basic constraints" extension. Even if you mark the certificate as a "trusted CA" in NSS, it still needs to have "CA: true" in the basic constraints extension in order to be accepted as an authority. But unfortunately many self-signed certificates do have this set, so giving the 'C' flag is indeed insecure. –  grawity May 17 '11 at 15:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.