2

I am setting up a dedicated machine to automate browser benchmarks of my web application. This needs to use HTTP/2 which requires an SSL connection so I have created a self signed CA and certificate for my local https server to use.

I added my self signed certificate to Debian, which seems to work as expected. It seems Chrome uses a built-in certificate store when on Linux that you add to via its GUI.

The issue is, my environment is a VPS running Debian so I cannot access the Chrome UI to add certificates via its UI.

I have installed my self signed root certificate to my system using the following commands:

$ sudo cp localhost.crt /usr/local/share/ca-certificates/localhost.crt
$ sudo update-ca-certificates

Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Now when hitting the server via curl, requests trust the self signed certificate

$ curl https://localhost:3000

<html></html>

However when using headless Chrome via Puppeteer, Chrome does not accept the certificate and exits.

I am aware that I can configure Puppeteer to ignore SSL warnings - this does result in different browser behaviours (particularly in terms of caching) so I cannot use it for my use case (automated performance benchmarks).

I know that under Linux, Chrome uses a built in certificate store. Is it possible to add to that store via terminal?

EDIT:

I tried to use certutil following the instructions from this post

$ certutil -d sql:$HOME/.pki/nssdb -A -t P -n localhost -i /usr/local/share/ca-certificates/localhost.crt

-d is the database and I verified that sql:$HOME/.pki/nssdb exists. -A Adds a certificate to the database, -t P says to mark it as a "trusted peer", -n is a nickname for the cert and -i is the cert path.

However upon rerunning the Puppeteer process, it still did not accept the certificate. Restarting the computer doesn't seem to change anything.

EDIT:

The following command worked. -t CP adds the cert as a trusted peer and CA. I don't know what the commas mean.

$ certutil -d sql:$HOME/.pki/nssdb -A -t "CP,CP," -n localhost -i /usr/local/share/ca-certificates/localhost.crt
Improve this question
1
  • You can answer your own question. That's better than leaving this dangling as an unanswered one.
    – garethTheRed
    Commented Mar 10, 2023 at 7:01

1 Answer 1

Reset to default
2

The following command worked.

First ensure certutil is installed with:

sudo apt install libnss3-tools

Then add the cert to the db:

$ certutil \
  -d sql:$HOME/.pki/nssdb \
  -A \
  -t "CP,CP," \
  -n localhost \
  -i /usr/local/share/ca-certificates/localhost-ca.crt

-t CP adds the cert as a trusted peer and CA. I don't know what the commas in -t "CP,CP," mean but it doesn't work without them.

Improve this answer
1
  • 2
    Thank you a lot. I was using -t "C,," and -t "CP,," fixed the issue with the latest Chrome/Chromium for me.
    – mvorisek
    Commented Jul 9, 2023 at 5:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .