I agree with everything BillThor mentioned, but i'll add that it may be necessary to completely rebuild the certificate store, because sometimes it seems like update-ca-certificates tries too hard to be lazy, and doesn't actually update things it should.
rm -f /usr/local/share/ca-certificates/certificate.crt
# --fresh is needed to remove symlinks to no-longer-present certificates
Also, note that once update-ca-certificates is complete, it should have symlinked the
/etc/ssl/certs/*.pem files to their respective certificates in
/usr/share/ca-certificates/. As BillThor mentioned, there will also be a symlink to a file with the fingerprint as a name - it will be similar to
An ls -l can confirm this:
lrwxrwxrwx 1 root root 72 Feb 6 2014 Security_Communication_EV_RootCA1.pem -> /usr/share/ca-certificates/mozilla/Security_Communication_EV_RootCA1.crt
lrwxrwxrwx 1 root root 69 Mar 25 2014 Security_Communication_RootCA2.pem -> /usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt
lrwxrwxrwx 1 root root 69 Feb 6 2014 Security_Communication_Root_CA.pem -> /usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt
lrwxrwxrwx 1 root root 61 Feb 6 2014 Sonera_Class_1_Root_CA.pem -> /usr/share/ca-certificates/mozilla/Sonera_Class_1_Root_CA.crt
Also notice that *.crt and *.pem are the same file. This means the original .crt put in place should be in .pem format.
A .pem format file looks like this:
You can test your certificate installation by running openssl against the cert:
openssl x509 -in /etc/ssl/certs/[certname].pem -noout -text
openssl x509 -in /usr/local/share/ca-certificates/[certname].pem -noout -text
(of course replacing [certname])
You should see some extensive info about your certificate, and both should match (since with a symlink they should be the same file).
If they don't match, then you should re-run
If they don't output useful info at all, then you need to check your cert and make sure it's in valid PEM format.
EDIT: BillThor mentioned this won't work for Java, but it appears as though on debian at least, Java's certificate store is also kept up to date by the update-ca-certificates tool. I'm not aware of other things on linux that use an alternative certificate store, besides perhaps Wine running an Adobe Air app.