Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My work has decided to issue their own certificate authority (CA) to handle different aspects of our work securely without paying for certificates.

  • Cryptographically sign emails
  • Encrypt email contents
  • Make access to things like the company IRC client-certificate based.
  • Revoke the keys of former employees automagically

They sent me a .pem file, and I'm not sure how to add it to my Ubuntu install. The instructions sent where: "Double-clicking on it on a Mac should install it."

How do I proceed? Do I need to do something with OpenSSL to create a .key, .csr, or .crt file?

share|improve this question
add comment

5 Answers

man update-ca-certificates:

update-ca-certificates  is  a  program  that  updates   the   directory
/etc/ssl/certs to hold SSL certificates and generates certificates.crt,
a concatenated single-file list of certificates.

It reads the file /etc/ca-certificates.conf. Each line gives a pathname
of  a  CA  certificate  under /usr/share/ca-certificates that should be
trusted.  Lines that begin with "#" are comment lines and thus ignored.
Lines  that  begin with "!" are deselected, causing the deactivation of
the CA certificate in question.

Furthermore   all   certificates   found   below   /usr/local/share/ca-
certificates are also included as implicitly trusted.

From the above, I would infer that the preferred way to get local certificate files into the trusted store is to put them into /usr/local/share/ca-certificates, and then run update-ca-certificates. You do not need to touch /etc/ssl/certs directly.

share|improve this answer
4  
Naming the certificates with .crt extensions seemed to be required as well. –  phyzome Mar 5 '13 at 23:12
add comment

You'll have to copy the certificate of the root CA to the /etc/ssl/certs directory in PEM format. Then you must run the update-ca-certificates script which will add the certificate to the certificate bundle (/etc/ssl/certs/ca-certificates.crt) and make the symlink from the file to its hash value.

share|improve this answer
1  
So $ sudo cp company.pem /etc/ssl/certs then $ sudo update-ca-certificates right? –  Xeoncross Jun 15 '12 at 16:37
    
That looks good. –  superuser Jun 15 '12 at 16:38
2  
Wrong! You’re supposed to put it in /usr/local/share/ca-certificates and with a .crt ending. –  Robert Siemer Mar 25 at 5:08
1  
In more detail, it's wrong not because it's wrong (and incomplete: what "hash value"?), but because that directory is read only by OpenSSL (and maybe NSS), but not by GnuTLS nor Java, so putting certs directly there makes them work only in some programs. In comparison, update-ca-certificates makes sure to add the cert to all locations needed – it regenerates the "bundle" (ca-certificates.crt) used by GnuTLS, adds the cert to Java certificate store, etc. –  grawity Mar 26 at 13:44
add comment

Installing a CA

Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it) into /usr/local/share/ca-certificates and name it with a .crt file extension.

Then run sudo update-ca-certificates.

Caveats: This installation only affects products that use this certificate store. Some products may use other certificate stores; if you use those products, you'll need to add this CA certificate to those other certificate stores, too. (Firefox Instructions, Chrome Instructions, Java Instructions)

Testing The CA

You can verify if this is worked by looking for the certificate that you just added in /etc/ssl/certs/ca-certificates.crt (which is just a long list of all of your trusted CA's concatenated together).

You can also use OpenSSL's s_client by trying to connect to a server that you know is using a certificate signed by the CA that you just installed.

$ openssl s_client -connect foo.whatever.com:443 -CApath /etc/ssl/certs

CONNECTED(00000003)
depth=1 C = US, ST = Virginia, O = "Whatever, Inc.", CN = whatever.com, emailAddress = admin@whatever.com
verify return:1
depth=0 C = US, ST = Virginia, L = Arlington, O = "Whatever, Inc.", CN = foo.whatever.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Virginia/L=Arlington/O=Whatever, Inc./CN=foo.whatever.com
   i:/C=US/ST=Virginia/O=Whatever, Inc./CN=whatever.com/emailAddress=admin@whatever.com

... snip lots of output ...

    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1392837700
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

The first thing to look for is the certificate chain near the top of the output. This should show the CA as the issuer (next to i:). This tells you that the server is presenting a certificate signed by the CA you're installign.

Second, look for the verify return code at the end to be set to 0 (ok).

share|improve this answer
add comment

The other answers regarding update-ca-certificates are correct for applications that read from the system certificate store. For Chrome and Firefox, and probably some others, the certificate must be put in the nssdb, the backend for the Mozilla NSS library.

From https://code.google.com/p/chromium/wiki/LinuxCertManagement:

For example, to trust a root CA certificate for issuing SSL server certificates, use

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> -i <certificate filename>

Where <certificate nickname> is arbitrary, and <certificate filename> is your .pem or .crt file.

Other helpful references:

share|improve this answer
add comment

I had same issue, and I had to copy the .pem file to /usr/local/share/ca-certificates, renaming it as .crt. The .cer file can easily be converted to .pem, with openssl, for example, if you don't have the .pem.

After copying the file you must execute sudo update-ca-certificates.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.