/etc/ssl/certs/ca-certificates.crt should not be just "your" SSL certificate. It should be a concatenation of all CA certificates that are trusted by OpenSSL, for programs that want the list of trusted CA certificates all in a single file.
Some programs that use OpenSSL will instead want the trusted CA certificates as separate files in a directory, with filenames that are certificate hashes of the form
HHHHHHHH.N where the N is usually 0 (if there are two or more certificates with identical hashes, the first will have the suffix
.0, the second
.1 etc). This is done by symbolic links in the
Both forms are managed by a
update-ca-certificates command, which is controlled by the
/etc/ca-certificates.conf file. The actual master copies of the root certificates are in sub-directories of
/usr/local/share/ca-certificates if you're chosen to add custom root certificates in The Debian Way).
If you want to exclude some of the default CA certificates (e.g. because they are expired and you are under orders to remove any expired certificates from the system configuration), you should edit
/etc/ca-certificates.conf, prefix the appropriate line with an exclamation mark, and then run
update-ca-certificates as root. For your custom CA certificates, you should remove them from the
/usr/local/share/ca-certificates/* sub-directory before running
update-ca-certificates instead. Otherwise,
update-ca-certificates will just add it back whenever theca-certificates` package is updated or reconfigured.
Note that having expired certificates in
/etc/ssl/certs should not normally be a problem: OpenSSL library functions will check for certificate expiration and will report expired certificates as a validation failure. Of course, if you have a system with no knowledge of real time and date, or a badly-programmed application that ignores certificate expiration, then you have a legitimate reason to remove expired certificates from configuration.
If you want to regenerate the
/etc/ssl/certs/ssl-cert-snakeoil.pem certificate, the command for that is:
make-ssl-cert generate-default-snakeoil --force-overwrite
This will overwrite the certificate
/etc/ssl/certs/ssl-cert-snakeoil.pem with a new self-signed certificate, and the file
/etc/ssl/private/ssl-cert-snakeoil.key with the corresponding new private key.