Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I add self-signed certificates to e.g: Google Chrome under Linux (from the command line)? Thank you!

share|improve this question
You should be able to use the certutil utility to do this (it's included in Debian/Ubuntu's libnss3-tools package and should be in a similar package in other distros). Unfortunately, I can't seem to get it to work on either Chrome or Firefox's NSS databases on my machine. – Patches May 17 '11 at 0:28
up vote 0 down vote accepted

According to LinuxCertManagement:

For example, to trust a root CA certificate for issuing SSL server certificates, use

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <nickname> -i <filename>

Note: to trust a self-signed server certificate, we should use

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <nickname> -i <filename>

Unfortunately that doesn't work because of NSS bug 531160. To work around the NSS bug, you have to trust it as a CA using the "C,," trust flags.

For Firefox, change the -d argument to Firefox profile path, without sql:.

share|improve this answer
So because of the bug it's really insecure to "C,," a self-signed certificate on XY website? – LanceBaynes May 17 '11 at 10:59
@LanceBaynes: All X.509 certificates have a "basic constraints" extension. Even if you mark the certificate as a "trusted CA" in NSS, it still needs to have "CA: true" in the basic constraints extension in order to be accepted as an authority. But unfortunately many self-signed certificates do have this set, so giving the 'C' flag is indeed insecure. – grawity May 17 '11 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .