Unix & Linux: Adding a self-signed certificate to the "trusted list" (5 Solutions!!)
👉 https://amzn.to/4aLHbLD 👈 You’re literally one click away from a better setup — grab it now! 🚀👑
As an Amazon Associate I earn from qualifying purchases. Unix & Linux: Adding a self-signed certificate to the "trusted list"
The Question: I've generated a self-signed certificate for my build server and I'd like to
globally trust the certificate on my machine, as I created the key myself and
I'm sick of seeing warnings.
I'm on Ubuntu 12.04. How can I take the certificate and globally trust it so
that browsers (Google Chrome), CLI utilities (wget, curl), and programming
languages (Python, Java, etc.) trust the connection to https://mysite.com
without asking questions?
Solutions: Please watch the whole video to see all solutions, in order of how many people found them helpful
== This solution helped 97 people ==
The simple answer to this is that pretty much each application will handle it
differently.
Also OpenSSL and GNUTLS (the most widely used certificate processing libraries
used to handle signed certificates) behave differently in their treatment of
certs which also complicates the issue. Also operating systems utilize
different mechanisms to utilize "root CA" used by most websites.
That aside, giving Debian as an example. Install the ca-certificates package:
apt-get install ca-certificates
You then copy the public half of your untrusted CA certificate (the one you use
to sign your CSR) into the CA certificate directory (as root):
cp cacert.pem /usr/share/ca-certificates
And get it to rebuild the directory with your certificate included, run as
root:
dpkg-reconfigure ca-certificates
and select the ask option, scroll to your certificate, mark it for inclusion
and select ok.
Most browsers use their own CA database, and so tools like certutil have to be
used to modify their contents (on Debian that is provided by the libnss3-tools
package). For example, with Chrome you run something along the lines of:
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "My Homemade CA" -i /path/to/
CA/cert.file
Firefox will allow you to browse to the certificate on disk, recognize it a
certificate file and then allow you to import it to Root CA list.
Most other commands such as curl take command line switches you can use to
point at your CA,
curl --cacert /path/to/CA/cert.file https://...
or drop the SSL validation altogether
curl --insecure https://...
The rest will need individual investigation if the ca-certificates like trick
does not sort it for that particular application.
== This solution helped 63 people ==
**** Non Interactive Approach ****
For use in a non-interactive context (e.g. a chef recipe) you can use the
following sequence.
sudo cp my.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
Tested and works on debian 5/6 & Ubuntu 14.04.
For more information, see man update-ca-certificates
This method is preferred over @Drav's method, since /usr/share/ is typically
reserved for files added by the OS / apt-get.
== This solution helped 8 people ==
On Fedora 23, add the .pem or .der file to /etc/pki/ca-trust/source/anchors/
and run sudo update-ca-trust extract.
See man update-ca-trust for details, e.g. whether to use /etc or /usr.
== This solution helped 5 people ==
In centos:
cp *.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust extract
With thanks & praise to God, and with thanks to the many people who have made this project possible! | Content (except music & images) licensed under cc by-sa 3.0 | Music: https://www.bensound.com/royalty-free... | Images: https://stocksnap.io/license & others | With thanks to user user7610 (https://unix.stackexchange.com/users/..., user oDDsKooL (https://unix.stackexchange.com/users/..., user Naftuli Kay (https://unix.stackexchange.com/users/..., user Drav Sloan (https://unix.stackexchange.com/users/..., user dragonfly (https://unix.stackexchange.com/users/..., user BobTuckerman (https://unix.stackexchange.com/users/..., user 3ronco (https://unix.stackexchange.com/users/..., and the Stack Exchange Network (http://unix.stackexchange.com/questio.... Trademarks are property of their respective owners. Disclaimer: All information is provided "AS IS" without warranty of any kind. You are responsible for your own actions. Please contact me if anything is amiss at Roel D.OT VandePaar A.T gmail.com.