Is it possible to install a custom CA certificate without the ca-certificates package on Debian?

Question

Is it possible to install a custom ca certificate on Debian without installing the ca-certificate package?

I tend to run my servers beyond the lifespan of each release, and I always seem to have problems after a few years. Simple problems, like cURL not being able to verify the legitimacy of the server, PHP's openssl.cafile and curl.cainfo, etc. Nothing devastating, but annoying.

I'm installing Buster now and want to avoid any problems from the get-go this time.

Ideally I'd like to download cacert.pem from curl.se (Mozilla source), put it in a directory, then tell the OS and any software that asks for it to use it. That way, when it expires I can just re-download the latest from curl.se or the Mozilla source.

Answer 1

update-ca-certificates is actually a shell script. You could just read it and adapt parts of it to your needs.

In a nutshell: when update-ca-certificates adds a certificate, it creates a symbolic link to /etc/ssl/certs/ pointing to the PEM-formatted certificate file. update-ca-certificates expects the CA certficate to be in a PEM formatted file with a *.crt suffix, and the link name will have that suffix changed to *.pem instead: so /etc/ssl/certs/<somename>.pem will be linked to /elsewhere/<somename>.crt.

OpenSSL requires that the directory containing trusted CA certificates has them accessible by their hashes, so within the /etc/ssl/certs/ directory, another symbolic link will be created: <certificate hash>.0 -> <somename>.pem. The <certificate hash> can be calculated manually with:

openssl x509 -in <certificate PEM file> -noout -hash

If another certificate has the same hash, then the .0 portion will be incremented to .1, then to .2 etc. until an unique name can be found. This hashing is not a security mechanism: it just allows OpenSSL to find the required CA certificate quickly by its hash when validating certificates.

Alternatively, cd /etc/ssl/certs; openssl rehash . can be used to create hash symlinks for all certificates within that directory.

The contents of the new certificate PEM file will also be appended to /etc/ssl/certificates/ca-certificates.crt, for those programs that only accept their list of trusted CA certificates as a single file. If the PEM-formatted certificate is missing its trailing newline character, the script will add one automatically when appending the certificate to ca-certificates.crt.

The update-ca-certificates script will also run any scripts placed into /etc/ca-certificates/update.d/.

In case you have any .dpkg-packaged version of Java installed, there will most likely be a script named /etc/ca-certificates/update.d/jks-keystore dropped by the Java package, which will similarly update the Java keystore file at /etc/ssl/certs/java/cacerts, so that it will also contain the exact same certificates as the OpenSSL CA certificate directory /etc/ssl/certs or the file /etc/ssl/certs/ca-certificates.crt.

Edited

Answer 2

• Copy my_own_ca.crt to /usr/local/share/ca-certificates
• run script update-ca-certificates

update-ca-certificates create necessary simlink and update /etc/ssl/certs/ca-certificates.crt file. Linux utilities tools like wget or curl use this file as CA file as default.

Or find the switch that specifies the CA file or switch for disable check certificate. For wget it is:

• wget --no-check-certificate - for disable CA check
• wget --ca-certificate=file - Use file as the file with the bundle of certificate authorities ("CA") to verify the peers. The certificates must be in PEM format.

Example

Copy your own ca with crt suffix to /usr/local/share/ca-certificates

/usr/local/share/ca-certificates# ls -alFh
celkem 16K
drwxrwsr-x 2 root staff 4,0K úno  5 13:02 ./
drwxrwsr-x 7 root staff 4,0K kvě  7  2014 ../
-rw-r--r-- 1 root staff 1,5K úno  5 13:02 thawte-Primary-Root-CA-G3.crt
-rw-r--r-- 1 root staff 1,7K úno  5 13:01 thawte-SHA256-ssl-ca.crt

Run update-ca-certificates

/usr/local/share/ca-certificates# update-ca-certificates 
Updating certificates in /etc/ssl/certs... WARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pem
WARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pem
WARNING: Skipping duplicate certificate thawte-primary-root.pem
WARNING: Skipping duplicate certificate thawte-primary-root.pem
2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....done.

Verify:

/etc/ssl/certs# ls -alFh | grep local
lrwxrwxrwx 1 root root   62 úno  5 13:03 thawte-Primary-Root-CA-G3.pem -> /usr/local/share/ca-certificates/thawte-Primary-Root-CA-G3.crt
lrwxrwxrwx 1 root root   57 úno  5 13:03 thawte-SHA256-ssl-ca.pem -> /usr/local/share/ca-certificates/thawte-SHA256-ssl-ca.crt

/etc/ssl/certs# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout

subject=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES
issuer=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES

subject=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.
issuer=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.

subject=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CA
issuer=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CA

subject=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
issuer=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

...

Find your CA