5

Is it possible to install a custom ca certificate on Debian without installing the ca-certificate package?

I tend to run my servers beyond the lifespan of each release, and I always seem to have problems after a few years. Simple problems, like cURL not being able to verify the legitimacy of the server, PHP's openssl.cafile and curl.cainfo, etc. Nothing devastating, but annoying.

I'm installing Buster now and want to avoid any problems from the start this time.

Ideally I'd like to download cacert.pem from curl.se (Mozilla source), put it in a directory, then tell the OS and any software that asks for it to use it. That way, when it expires I can just re-download the latest from curl.se or the Mozilla source.

4
  • 1
    An useful command to handle custom certs is update-ca-certificates part of... ca-certificates.
    – A.B
    Commented Jan 30, 2022 at 22:09
  • 1
    Every answer I found searching led straight to update-ca-certificates, which is a part of the ca-certificates package. That's why I asked this question so specifically. Some linux guru has to know how to do it.
    – Jeff
    Commented Jan 30, 2022 at 23:02
  • Could you update the question to explain why you don't want to install package ca-certificates? The whole point of that package is to add global well-known CAs as trusted and also support easily adding your own CA certificates. It seems the use case you're describing would nicely fit in this description. Commented Jul 4 at 10:30
  • The reason you should use package ca-certificates is because it automates the procedure to install a new CA certificate. And and want to automate it because due historical reasons, different apps want CA certificates specified in different way and the update-ca-certificates generates all the versions that you need. If you truly want to do this manually, read at least the documentation of OpenSSL and GNUTLS to figure out how each system wants to access the CA certificates. If you don't like to read the manuals, just install ca-certificates. Commented Jul 4 at 10:40

2 Answers 2

9

update-ca-certificates is actually a shell script. You could just read it and adapt parts of it to your needs.

In a nutshell: when update-ca-certificates adds a certificate, it creates a symbolic link to /etc/ssl/certs/ pointing to the PEM-formatted certificate file. update-ca-certificates expects the CA certficate to be in a PEM formatted file with a *.crt suffix, and the link name will have that suffix changed to *.pem instead: so /etc/ssl/certs/<somename>.pem will be linked to /elsewhere/<somename>.crt.

OpenSSL requires that the directory containing trusted CA certificates has them accessible by their hashes, so within the /etc/ssl/certs/ directory, another symbolic link will be created: <certificate hash>.0 -> <somename>.pem. The <certificate hash> can be calculated manually with:

openssl x509 -in <certificate PEM file> -noout -hash

If another certificate has the same hash, then the .0 portion will be incremented to .1, then to .2 etc. until an unique name can be found. This hashing is not a security mechanism: it just allows OpenSSL to find the required CA certificate quickly by its hash when validating certificates.

Alternatively, cd /etc/ssl/certs; openssl rehash . can be used to create hash symlinks for all certificates within that directory.

The contents of the new certificate PEM file will also be appended to /etc/ssl/certificates/ca-certificates.crt, for those programs that only accept their list of trusted CA certificates as a single file. If the PEM-formatted certificate is missing its trailing newline character, the script will add one automatically when appending the certificate to ca-certificates.crt.

The update-ca-certificates script will also run any scripts placed into /etc/ca-certificates/update.d/.

In case you have any .dpkg-packaged version of Java installed, there will most likely be a script named /etc/ca-certificates/update.d/jks-keystore dropped by the Java package, which will similarly update the Java keystore file at /etc/ssl/certs/java/cacerts, so that it will also contain the exact same certificates as the OpenSSL CA certificate directory /etc/ssl/certs or the file /etc/ssl/certs/ca-certificates.crt.

Edited

0
3
  • Copy my_own_ca.crt to /usr/local/share/ca-certificates
  • run script update-ca-certificates

update-ca-certificates create necessary simlink and update /etc/ssl/certs/ca-certificates.crt file. Linux utilities tools like wget or curl use this file as CA file as default.

Or find the switch that specifies the CA file or switch for disable check certificate. For wget it is:

  • wget --no-check-certificate - for disable CA check
  • wget --ca-certificate=file - Use file as the file with the bundle of certificate authorities ("CA") to verify the peers. The certificates must be in PEM format.

Example

Copy your own ca with crt suffix to /usr/local/share/ca-certificates

/usr/local/share/ca-certificates# ls -alFh
celkem 16K
drwxrwsr-x 2 root staff 4,0K úno  5 13:02 ./
drwxrwsr-x 7 root staff 4,0K kvě  7  2014 ../
-rw-r--r-- 1 root staff 1,5K úno  5 13:02 thawte-Primary-Root-CA-G3.crt
-rw-r--r-- 1 root staff 1,7K úno  5 13:01 thawte-SHA256-ssl-ca.crt

Run update-ca-certificates

/usr/local/share/ca-certificates# update-ca-certificates 
Updating certificates in /etc/ssl/certs... WARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pem
WARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pem
WARNING: Skipping duplicate certificate thawte-primary-root.pem
WARNING: Skipping duplicate certificate thawte-primary-root.pem
2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....done.

Verify:

/etc/ssl/certs# ls -alFh | grep local
lrwxrwxrwx 1 root root   62 úno  5 13:03 thawte-Primary-Root-CA-G3.pem -> /usr/local/share/ca-certificates/thawte-Primary-Root-CA-G3.crt
lrwxrwxrwx 1 root root   57 úno  5 13:03 thawte-SHA256-ssl-ca.pem -> /usr/local/share/ca-certificates/thawte-SHA256-ssl-ca.crt
/etc/ssl/certs# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout

subject=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES
issuer=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES

subject=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.
issuer=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.

subject=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CA
issuer=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CA

subject=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
issuer=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

...

Find your CA
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .