Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've generated a self-signed certificate for my build server and I'd like to globally trust the certificate on my machine, as I created the key myself and I'm sick of seeing warnings.

I'm on Ubuntu 12.04. How can I take the certificate and globally trust it so that browsers (Google Chrome), CLI utilities (wget, curl), and programming languages (Python, Java, etc.) trust the connection to https://mysite.com without asking questions?

share|improve this question
All the TLS should be vectored through OpenSSL, so that's the place to look for documentation. In this case: gagravarr.org/writing/openssl-certs/… looks useful. – msw Sep 13 '13 at 2:06
up vote 25 down vote accepted

The simple answer to this is that pretty much each application will handle it differently.

Also OpenSSL and GNUTLS (the most widely used certificate processing libraries used to handle signed certificates) behave differently in their treatment of certs which also complicates the issue. Also operating systems utilize different mechanisms to utilize "root CA" used by most websites.

That aside, giving Debian as an example. Install the ca-certificates package:

apt-get install ca-certificates

You then copy the public half of your untrusted CA certificate (the one you use to sign your CSR) into the CA certificate directory (as root):

cp cacert.pem /usr/share/ca-certificates

And get it to rebuild the directory with your certificate included, run as root:

dpkg-reconfigure ca-certificates

and select the ask option, scroll to your certificate, mark it for inclusion and select ok.

Most browsers use their own CA database, and so tools like certutil have to be used to modify their contents (on Debian that is provided by the libnss3-tools package). For example, with Chrome you run something along the lines of:

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "My Homemade CA" -i /path/to/CA/cert.file

Firefox will allow you to browse to the certificate on disk, recognize it a certificate file and then allow you to import it to Root CA list.

Most other commands such as curl take command line switches you can use to point at your CA,

 curl --cacert  /path/to/CA/cert.file https://...

or drop the SSL validation altogether

 curl --insecure https://...

The rest will need individual investigation if the ca-certificates like trick does not sort it for that particular application.

share|improve this answer
Also, as noted here, adding CA certificates for Java is likewise a separate matter. – Naftuli Tzvi Kay Mar 28 '14 at 0:40
After copying the certificate to /usr/share/ca-certificates, I can't see it in the dpkg-reconfigure ca-certificates list. What am I doing wrong? – Georges Dupéron Feb 17 '15 at 19:21
@GeorgesDupéron That happened to me to. I resolved it by renaming the cert from whatever.pem to whatever.crt. – Hello World Oct 3 '15 at 7:19

For use in a non-interactive context (e.g. a chef recipe) you can use the following sequence:

Based on http://blog.sandipb.net/2009/08/08/adding-new-ca-certificates-in-ubuntu-jaunty/, you can do the following sequence that doesn't need interactive selection:

sudo cp my.cert /usr/local/share/ca-certificates/
sudo update-ca-certificates

tested and works on debian 5/6.

share|improve this answer
It is better to copy the files to /usr/local/share/ca-certificates/ as mentioned in the man pages – ortang Feb 4 at 10:20

On Fedora 23, add the .pem or .der file to /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract.

See man update-ca-trust for details, e.g. whether to use /etc or /usr.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.