When running sudo lynis audit system it tells me that two of my SSL certificates expired, namely: /etc/ssl/certs/ca-certificates.crt and /etc/ssl/certs/ssl-cert-snakeoil.pem.

What should I do to fix this problem? Remove those certificates? If so how? I'm using Debian 9.1 with KDE.

  • Note that that certificate is created by Debian's ssl-cert package. Commented Mar 22, 2019 at 10:48

2 Answers 2


/etc/ssl/certs/ca-certificates.crt should not be just "your" SSL certificate. It should be a concatenation of all CA certificates that are trusted by OpenSSL, for programs that want the list of trusted CA certificates all in a single file.

Some programs that use OpenSSL will instead want the trusted CA certificates as separate files in a directory, with filenames that are certificate hashes of the form HHHHHHHH.N where the N is usually 0 (if there are two or more certificates with identical hashes, the first will have the suffix .0, the second .1 etc). This is done by symbolic links in the /etc/ssl/certs directory.

Both forms are managed by a update-ca-certificates command, which is controlled by the /etc/ca-certificates.conf file. The actual master copies of the root certificates are in sub-directories of /usr/share/ca-certificates/ (and /usr/local/share/ca-certificates if you're chosen to add custom root certificates in The Debian Way).

If you want to exclude some of the default CA certificates (e.g. because they are expired and you are under orders to remove any expired certificates from the system configuration), you should edit /etc/ca-certificates.conf, prefix the appropriate line with an exclamation mark, and then run update-ca-certificates as root. For your custom CA certificates, you should remove them from the /usr/local/share/ca-certificates/* sub-directory before running update-ca-certificates instead. Otherwise, update-ca-certificates will just add it back whenever theca-certificates` package is updated or reconfigured.

Note that having expired certificates in /etc/ssl/certs should not normally be a problem: OpenSSL library functions will check for certificate expiration and will report expired certificates as a validation failure. Of course, if you have a system with no knowledge of real time and date, or a badly-programmed application that ignores certificate expiration, then you have a legitimate reason to remove expired certificates from configuration.

If you want to regenerate the /etc/ssl/certs/ssl-cert-snakeoil.pem certificate, the command for that is:

make-ssl-cert generate-default-snakeoil --force-overwrite

This will overwrite the certificate /etc/ssl/certs/ssl-cert-snakeoil.pem with a new self-signed certificate, and the file /etc/ssl/private/ssl-cert-snakeoil.key with the corresponding new private key.


There should be a "ca-certificates" package on your distro's package repository.

Upgrade that package and your installed CA certificates will be upgraded.

Btw, if you remove ca-certificates.crt from your system, you won't be able to trust anyone's SSL certificate.

  • It's already the latest version of the official Debian repositories but I still get that warning!
    – mYnDstrEAm
    Commented Aug 24, 2017 at 23:25
  • Which version of Debian are you using? Commented Aug 25, 2017 at 0:52
  • The latest one: 9.1. (No particular distribution but the original Debian from the official website installed from DVD.)
    – mYnDstrEAm
    Commented Aug 25, 2017 at 11:43
  • Try with command update-ca-certificates Commented Aug 25, 2017 at 18:06
  • This doesn't seem to work. The output of sudo update-ca-certificates is: Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... done. Updating Mono key store Linux Cert Store Sync - version Synchronize local certs with certs from local Linux trust store. Copyright 2002, 2003 Motus Technologies. Copyright 2004-2008 Novell. BSD licensed. I already trust 166, your new list has 166 Import process completed. Done done. and I still get that warning.
    – mYnDstrEAm
    Commented Aug 28, 2017 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .