4

How do you install a self signed cert chain into Alpine Linux?

I've a self signed cert chain that I've been using in Ubuntu, for example:

bacon.crt

-----BEGIN CERTIFICATE-----
328FjQIFJNVBLAHBLAH
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
7CJAMIDDLEBLAH80A
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
328FjOTHERVBLAHBLAH
-----END CERTIFICATE-----

And in Ubuntu, I run the following commands to install this cert chain:

cp /tmp/certs/bacon.crt /usr/local/share/ca-certificates/bacon.crt
update-ca-certificates

Easy!


However, on Alpine Linux:

# cp /tmp/certs/bacon.crt /usr/local/share/ca-certificates/bacon.crt
/usr/local/share/ca-certificates # update-ca-certificates
WARNING: ca-cert-bacon.crt.pem does not contain exactly one certificate or CRL: skipping

And if I try to break my certs into 3 chunks to spoon-feed this distro:

/tmp/certs/1.crt

-----BEGIN CERTIFICATE-----
328FjQIFJNVBLAHBLAH
-----END CERTIFICATE-----

/tmp/certs/2.crt

-----BEGIN CERTIFICATE-----
328FjOTHERVBLAHBLAH
-----END CERTIFICATE-----

/tmp/certs/3.crt

-----BEGIN CERTIFICATE-----
328FjQIFJNVBLAHBLAH
-----END CERTIFICATE-----

Now it doesn't throw an error during cert installation but still can't authenticate against other self-signed endpoints.

| improve this question | | | | |
  • Shouldn't you configure it in nginx also? – chicks Aug 22 '18 at 19:47
  • @chicks - I do not leverage nginx anywhere in this setup. – Rakaim Aug 23 '18 at 14:25
  • Then how are you trying to authenticate with these certs? Via ssh? – chicks Aug 23 '18 at 14:39
  • @chicks - I'm attempting to upload a docker image from this Alpine Linux image to an internal Docker Registry. The docker daemon leverages the machine's certs to execute the docker login. Again, this is working fine on all my other Linux machines (Ubuntu, CentOS, RHEL, Debian) as those Linux variations are able to swallow a whole cert chain in one gulp, where this one complains. – Rakaim Aug 23 '18 at 15:10
  • 1
    You can flag the question and ask the moderators move it so you don't have to delete it on one site and create it on another site. It also resets the question's score. For whatever reasons, the Stack Exchange network does not allow you to migrate it yourself. Also see Author initiated migration to other SE sites? – user56041 Aug 23 '18 at 16:08
9

Figured it out. Gosh.

/etc/ssl/certs/ca-certificates.crt is actually appending each individual cert from /usr/local/share/ca-certificates.

  1. Get a clean environment (This was my first major issue)
  2. Break your certs chain into a separate parts for each BEGIN/END pair you have.
    1. company-Root.crt
    2. company-X.crt
    3. company-Y.crt
    4. company-Z.crt
    5. company-Issuing.crt
  3. If you're being extra careful, load one at a time, starting with the company-Root.crt cert, then run update-ca-certificates.
  4. Repeat until all certs have been processed.
  5. Verify that /etc/ssl/certs/ca-certificates.crt contains the updates at the bottom of the file.
| improve this answer | | | | |
  • command from 3. always gives me WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping though my crt file contains only one bunch of begin-end – vladkras Nov 12 '19 at 15:50
  • 1
    ok, i've found a solution here stackoverflow.com/a/54100906/1713660 – vladkras Nov 12 '19 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.