7

How do I add trusted certificates for google-chrome at the command line?

For Firefox, I can use certutil binary.

For google-chrome, which binary or what steps are required?

1 Answer 1

7

According to this blog post it sounds like the technique is identical for Chrome as well, "Adding SSL certificates to Google Chrome Linux (Ubuntu)". The directions from that post were specific to Ubuntu but should be easily adapted to other Linux variants.

NOTE: Much of the contents below was excerpted from this article!

1. Add Software

$ sudo apt-get install libnss3-tools
$ sudo apt-get install curl

2. Adding CAcert certificates

$ curl -k -o "cacert-root.crt"   "http://www.cacert.org/certs/root.crt"
$ curl -k -o "cacert-class3.crt" "http://www.cacert.org/certs/class3.crt"
$ certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "CAcert.org" -i cacert-root.crt 
$ certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "CAcert.org Class 3" -i cacert-class3.crt

3. Create script

This will download and import the certificate into the certificate DB. We're calling the script: import-cert.sh.

#!/bin/sh
#
# usage:  import-cert.sh remote.host.name [port]
#
REMHOST=$1
REMPORT=${2:-443}
exec 6>&1
exec > $REMHOST
echo | openssl s_client -connect ${REMHOST}:${REMPORT} 2>&1 |sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "$REMHOST" -i $REMHOST 
exec 1>&6 6>&-

4. Adding certs

You can now run this script like so.

  1. To add a certificate from a site you type the following:

     $ import-cert.sh dirae.lunarservers.com 2083
    

In this case it uses port 2083 instead of the default port 443. If it’s the default port you don’t have to include the port.

  1. To see which certificates are included your database:

     $ certutil -L -d sql:$HOME/.pki/nssdb
    
  2. And should you want to delete a certificate

     $ certutil -D -n  -d sql:$HOME/.pki/nssdb
    

References

4
  • 1
    I followed the mentioned command. As per command, certificate get added into database, as I can see that in list of certutil -L ... command. But in chrome browser, it says certificate is missing or calling the site untrusted. Also, in chrome's certificate manager, added certificate is missing
    – SHW
    Apr 2, 2014 at 14:19
  • When executed chromium browser from command line, I am greeted with an error "9415:9415:0403/164329:ERROR:nss_util.cc(750)] After loading Root Certs, loaded==false: NSS error code: -8018"
    – SHW
    Apr 3, 2014 at 11:20
  • as you blindly copied & pasted from the blog you reference, you also copied the errors; seems like neither of the authors has actually tested what they're publishing...
    – ssc
    Apr 22, 2016 at 13:11
  • @ssc - I mentioned multiple times in the post that it's from a blog. I don't have access to this system to try so your mileage will vary. If there are things to fix, then I strongly encourage you to fix them here. Complaining about it doesn't really "fix" anything. Also the OP accepted it, so that tells me that it worked to some degree.
    – slm
    Apr 22, 2016 at 21:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .