7

I have a bunch of machines that need to fetch https: off a server (or collection of servers). I'm operating a CA and self-signing the certificates on the server(s).

The client machines are running ubuntu. Some of the fetches are via apt, some via wget.

How do I install the CA's certificate on the clients so that all of its certs are recognized without warnings or errors? (Just the directory location is sufficient, I'll package it in an appropriate way.)

Thanks.

Improve this question
0

4 Answers 4

Reset to default
11

Copying the *.pem file for your certification authority to /etc/ssl/certs/ should do the trick.

Improve this answer
3
  • 5
    And running sudo c_rehash.
    – phs
    Dec 10, 2013 at 7:39
  • 6
    -1'd, since this directory is only used by OpenSSL, so programs using e.g. GnuTLS or Java still won't know about the CA.
    – u1686_grawity
    Dec 2, 2014 at 15:32
  • Worked for me with my .NET Core 2.1 program. Not sure what library it uses under the covers. I thought libcurl.
    – Michael Welch
    Oct 25, 2018 at 19:53
30

On Ubuntu 12.04 (precise), you have to drop the certificate file to /usr/local/share/ca-certificates and it has to end with .crt

Then run update-ca-certificates. It should tell you: "1 added, 0 removed; done."

Note that unfortunately firefox does not honor the system installed certificates ( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=316436 ). You can use wget or w3m, which do honor them, to test if the certificate works.

Improve this answer
2

You'll have to copy the certificate of the root CA to the /etc/ssl/certs directory in PEM format. Then you must run the update-ca-certificates script which will add the certificate to the certificate bundle (/etc/ssl/certs/ca-certificates.crt) and make the symlink from the file to its hash value.

Improve this answer
1

Not what you asked, but I recommend www.cacert.org for certs. It's free but installed by default in all browsers. It is in more browsers than your self-signed cert though.

Improve this answer
1
  • 1
    I use StartSSL's free certs, which are recognised by all the major browsers.
    – paradroid
    Jan 28, 2012 at 19:55

Not the answer you're looking for? Browse other questions tagged .