Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
  1. I have set up a proxy server with SSL using a PEM certificate. Now, there is a couple of machines of mine that I would like to trust this certificate automatically (without the web browser complaining). How can I install a PEM certificate on each machine?

  2. Also, what is more recommended: generating a self signed certificate or concatenating the snakeoil certificate?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Browsers have a list of trusted "certification authority" (CA) certificates. If a server's certificate is signed by one of those CA certificates and properly formed, you won't get the SSL warning.

Many browsers ship with many common CA certificates such as Verisign, Thawte, etc. Most browsers allow you to import a new CA into this list of trusted CAs.

Like creating your own self-signed server certificate, you can create your own self-signed CA certificate. You can then use that to sign your server certificate. If your CA is not provided by a well-known company, which it wouldn't be if it's one you made, it will have to be explicitly imported on the server side.

I've used xca to do this before. It has templates for CAs and HTTP servers. The procedure is this:

  • Create a private key for your CA
  • Create a self-signed CA using this key using the "CA" template
  • Create a private key for your proxy server
  • Create a "certificate signing request" (CSR) using the second key, referencing the CA you just made.
  • "Sign" the CSR and you'll have the proxy server certificate, which references your own CA.

You will then need to export (as a file if using xca) the CA certificate (but don't include private key of course). A .pem will be generated but you can change the extension to .crt. When a user clicks on that, it will be offered to be installed on Firefox and Internet Explorer, and possibly other major browsers. As far as automatic installation of this .crt, you can:

  • use group policy on IE
  • direct users to an introduction page asking them to download/install the .crt if they want to avoid warnings.

You can then use the export functions on HTTP server certificate (export both private key and certificate for the server side) to put on your proxy server.

share|improve this answer
  1. Copy your cert to /etc/ssl/certs on the target system. Then create a symlink using the hash generated by the command openssl x509 -noout -hash -in ca-certificate-file replacing ca-certificate-file with your certificate name. Your certificate should then be accepted by all programs without their own certificate store.

    For programs with their own certificate store (browsers, Java, and others) you will need to import the certificate.

  2. Generating your own self-signed or signed certificate is best.

    You may want to install tinyca2 and generate your own certificate authority. You can import the certificate authority certificate as detailed in the steps above. Generate and deploy signed certificates for your applications.

    Distribute your CA certificate to those users who need to trust your certificate. You may need to provide information on how to import the certificate to them. WARNING: If they do this, you become another trusted CA for them, so secure your CA accordingly.

    Many tools can also be configured to trust self-signed certificates, or certificates with untrusted CAs. This is usually a one time action. This can be more secure that accepting an CA certificate from an insecure authority, only the accepted certificate is trusted.

share|improve this answer
    
Can this be made more specific? For example: host A sends mail to host B and complains about not being able to verify the identity of B. On host B, we have created a self-signed certificate: /etc/ssl/certs/ssl-cert-snakeoil.pem (this is what the Debian package ssl-cert creates for you). We copy it to host A and call it /etc/ssl/certs/host-B.pem (since this host might already have a ssl-cert-snakeoil.pem). Then we run ln -s /etc/ssl/certs/host-B.pem $(openssl x509 -noout -hash -in /etc/ssl/certs/host-B.pem). –  Alex Schröder Nov 16 at 8:16
    
@AlexSchröder I've edited above. They should not import your snakeoil certificate, but if you've setup your own CA, it is reasonable for them import your CA. I haven't yet identified trust issues between SMTP servers. Most clients can be told to trust individual certificates. –  BillThor Nov 16 at 15:03
    
Thanks. I found this question when I was looking for an explanation for a log entry I'm getting. The explanation I found was that where as A will send mail to B, A will report that it wasn't possible to verify the identity of B. –  Alex Schröder Nov 17 at 8:11

On Debian and Ubuntu you have to copy the certificate.pem to /usr/local/share/ca-certificates and then run update-ca-certificates. /etc/ssl/certs is managed by that command.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.