Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I am building vim from source and keep having to update the SSL hostfingerprints of my ~/.hgrc file. It's getting a little silly and large – see below. The pattern is the same: run update, find SSL finger print has changed, update fingerprint…

Anyone knows of a simpler way to keep this updated?

### openssl s_client -connect < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
[hostfingerprints] = CB:F1:C8:AC:28:D5:61:B7:C1:9C:73:7E:3A:B6:BB:E2:E6:55:95:2A = 52:BC:6F:6A:D5:86:38:B1:F5:FE:07:B3:A5:88:72:DC:EB:49:BF:5D = FD:02:92:B1:B3:32:27:F4:7B:40:3D:0A:CA:9E:DD:EE:22:17:52:02 = F6:21:3F:1D:BA:DC:6A:0D:7C:AF:00:E4:C4:12:87:DC:1B:7C:1D:11 = A0:60:E5:C3:DB:27:FB:31:B5:B2:D2:79:8E:24:4D:70:0E:E0:4B:EE = 65:A0:A7:8D:8F:48:EB:13:5C:81:3C:47:2D:6B:73:C4:7E:EA:61:5F
share|improve this question

1 Answer 1

up vote 8 down vote accepted

Have a look at - it should be enough to specify the cacerts. In short don't depend on the specific fingerprint but check if the cert is signed by a trusted source.

For Debian/Ubuntu/Arch/Gentoo:

cacerts = /etc/ssl/certs/ca-certificates.crt


cacerts = /etc/pki/tls/certs/ca-bundle.crt
share|improve this answer
That seems to work. Thank you. – Sardathrion Jun 25 '12 at 7:13
Or if you don't want to trust every certificate authority, you can download only the Google Internet Authority CA certificate from – Mikel Jun 26 '12 at 4:28
For OS-X: brew install curl-ca-bundle and then point cacerts at /usr/local/share/ca-bundle.crt – The Doctor What Apr 25 '13 at 0:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.