I'm trying to add a CA certificate to OpenBSD.

  • I have copied the conmpany.crt to /etc/ssl/private
  • I have created the .0 file from the certificate (using openssl x509 -hash -noout -in company.crt)
  • I can run openssl verify -CApath /etc/ssl/private/ company.crt just fine; result: company.crt: OK

However, when I try: curl -vi https://company.example/ I get:

*   Trying 192.168.XXX.XXX...
* Connected to company.example (192.168.XXX.XXX) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

From what I gather from the message curl looks at/in /etc/ssl/cert.pem. I could add the .crt to that file but a) I don't know what the correct way is and b) won't it get removed whenever I update all Root Certificates? I was hoping I could keep our own certificate(s) in a separate location. I haven't been able to find much on google so far other than that a .0 file is, apparently, required. But then on how to actually use the certificate is nowhere to be found.

Oh, also, the provided link in the error message (https://curl.haxx.se/docs/sslcerts.html) isn't very helpful.

To be clear, this is what I do on Debian machines which works fine:

  • Copy the company.crt to /usr/local/share/ca-certificates/company (where the company directory has chmod 755 and the company.crt has chmod 644)
  • Run update-ca-certificates
  • ...
  • Profit

You can append the cert to the end of /etc/ssl/cert.pem:

# cat mycert.pem >> /etc/ssl/cert.pem

which will stick across updates (see man sysmerge).

Note that sometimes the file is ignored (e.g. some browsers only trust their own CA repository).

| improve this answer | |
  • Great! Thanks for confirming and pointing me in the right direction! – RobIII May 6 '19 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.