Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I add self-signed certificates to e.g: Google Chrome under Linux (from the command line)? Thank you!

share|improve this question
You should be able to use the certutil utility to do this (it's included in Debian/Ubuntu's libnss3-tools package and should be in a similar package in other distros). Unfortunately, I can't seem to get it to work on either Chrome or Firefox's NSS databases on my machine. – Patches May 17 '11 at 0:28
up vote 0 down vote accepted

According to LinuxCertManagement:

For example, to trust a root CA certificate for issuing SSL server certificates, use

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <nickname> -i <filename>

Note: to trust a self-signed server certificate, we should use

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <nickname> -i <filename>

Unfortunately that doesn't work because of NSS bug 531160. To work around the NSS bug, you have to trust it as a CA using the "C,," trust flags.

For Firefox, change the -d argument to Firefox profile path, without sql:.

share|improve this answer
So because of the bug it's really insecure to "C,," a self-signed certificate on XY website? – LanceBaynes May 17 '11 at 10:59
@LanceBaynes: All X.509 certificates have a "basic constraints" extension. Even if you mark the certificate as a "trusted CA" in NSS, it still needs to have "CA: true" in the basic constraints extension in order to be accepted as an authority. But unfortunately many self-signed certificates do have this set, so giving the 'C' flag is indeed insecure. – grawity May 17 '11 at 15:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.