I have removed a (root) certicate, and re-run update-ca-certificates:

$ sudo rm /usr/local/share/ca-certificates/mine.root-ca.crt
ls -l /usr/local/share/ca-certificates/
total 4
-rw-r--r-- 1 root root 1838 Feb 16  2017 something-else.crt
$ sudo update-ca-certificates
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...


$ ls -l /etc/ssl/certs/mine.root-ca.pem
lrwxrwxrwx 1 root root 53 Jun  4 07:22 /etc/ssl/certs/mine.root-ca.pem -> /usr/local/share/ca-certificates/mine.root-ca.crt

But that file (/usr/local/share/ca-certificates/mine.root-ca.crt) does not exist anymore.

Actually, the 0 added, 0 removed; done. is suspicious: it should say 1 removed.

Certificate validation does not work anymore for the domain in question (as expected), but these two facts annoy me:

  • the lingering link
  • the fact that update-ca-certificates does not seem to do anything

I am in:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.4 LTS
Release:        16.04
Codename:       xenial

According to the man pages for update-ca-certificates, add the -f switch to remove symlinks in /etc/ssl/certs

-f, --fresh
          Fresh updates.  Remove symlinks in /etc/ssl/certs directory.

This will create a new ca-certificate.crt file without your root CA certificate and remove the symlink.

sudo update-ca-certificates -f

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.