8

There are different methods of storing a certificate file? DER, PEM, PKCS: PKCS7 & PKCS12?

Are all of these formats accept as valid in /usr/local/share/ca-certificates?

2 Answers 2

8

Certificates are added to the CA certificate database using the update-ca-certificates command. This is a shell script that scans the source certificate directories and adds any certificates found to the certificate bundle (/etc/ssl/certs/ca-certificates.crt) as well as creating a symlink in /etc/ssl/certs to the certificate.

The ca-certificates.crt file is a concatenation of certificates, each in PEM format.

The script doesn't convert any certificate formats, therefore it assumes that all certificates in the source folders are in PEM format with a .crt file extension.

4
  • 2
    This is correct. Nevertheless, it drives me nuts that a text formatted (PEM) file must be named as a binary formatted (DER/CRT) one, in order to get installed with update-ca-certificates command.
    – Václav
    Feb 23, 2023 at 21:21
  • 1
    @Václav - I'm not sure .crt means anything. A file extension is just some letters after a dot. Linux doesn't really care whether its .crt, .pem or .dog or .cat. It is odd that the scripts accepts only certificates which end in .crt though. Feb 23, 2023 at 21:51
  • yes, that's correct. What I'm saying is that DER format had been in use since 1980s and certificates have been stored with .crt ending. This is why people on the Internet keep referring to CRT format as binary format, along with DER format. Like in this question: superuser.com/questions/1207739/… Or this question: stackoverflow.com/questions/13732826/convert-pem-to-crt-and-key Textual format PEM has appeared in 1990s, that is why certificate files with .pem extension may be associated in people's minds with textual format only. But you're right, this confusion isn't legit
    – Václav
    Feb 28, 2023 at 21:31
  • Still relevant in 2023 for Ubuntu 22.04
    – Trevor
    Jul 20, 2023 at 16:55
0

There are different methods of storing a certificate file? DER, PEM, PKCS: PKCS7 & PKCS12?

Yes, these are.

And,

Are all of these formats accept as valid in /usr/local/share/ca-certificates?

From man update-ca-certificates FILES section:

   /usr/local/share/ca-certificates
          Directory of local CA certificates (with .crt extension).

I think the answer is no, only PEM .crt format may be accepted as valid in there, use it to be sure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .