up vote 4 down vote favorite
share [g+] share [fb]

How can I add self-signed certificates to e.g: Google Chrome under Linux (from the command line)? Thank you!

link|improve this question
62% accept rate
You should be able to use the certutil utility to do this (it's included in Debian/Ubuntu's libnss3-tools package and should be in a similar package in other distros). Unfortunately, I can't seem to get it to work on either Chrome or Firefox's NSS databases on my machine. – Patches May 17 '11 at 0:28
feedback

1 Answer

up vote 0 down vote accepted

According to LinuxCertManagement:

For example, to trust a root CA certificate for issuing SSL server certificates, use

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <nickname> -i <filename>

Note: to trust a self-signed server certificate, we should use

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <nickname> -i <filename>

Unfortunately that doesn't work because of NSS bug 531160. To work around the NSS bug, you have to trust it as a CA using the "C,," trust flags.

For Firefox, change the -d argument to Firefox profile path, without sql:.

link|improve this answer
So because of the bug it's really insecure to "C,," a self-signed certificate on XY website? – LanceBaynes May 17 '11 at 10:59
@LanceBaynes: All X.509 certificates have a "basic constraints" extension. Even if you mark the certificate as a "trusted CA" in NSS, it still needs to have "CA: true" in the basic constraints extension in order to be accepted as an authority. But unfortunately many self-signed certificates do have this set, so giving the 'C' flag is indeed insecure. – grawity May 17 '11 at 15:00
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.