update-ca-certificates is actually a shell script. You could just read it and adapt parts of it to your needs.
In a nutshell: when
update-ca-certificates adds a certificate, it creates a symbolic link to
/etc/ssl/certs/ pointing to the PEM-formatted certificate file.
update-ca-certificates expects the CA certficate to be in a PEM formatted file with a
*.crt suffix, and the link name will have that suffix changed to
*.pem instead: so
/etc/ssl/certs/<somename>.pem will be linked to
OpenSSL requires that the directory containing trusted CA certificates has them accessible by their hashes, so within the
/etc/ssl/certs/ directory, another symbolic link will be created:
<certificate hash>.0 -> <somename>.pem. The
<certificate hash> can be calculated manually with:
openssl x509 -in <certificate PEM file> -noout -hash
If another certificate has the same hash, then the
.0 portion will be incremented to
.1, then to
.2 etc. until an unique name can be found. This hashing is not a security mechanism: it just allows OpenSSL to find the required CA certificate quickly by its hash when validating certificates.
cd /etc/ssl/certs; openssl rehash . can be used to create hash symlinks for all certificates within that directory.
The contents of the new certificate PEM file will also be appended to
/etc/ssl/certificates/ca-certificates.crt, for those programs that only accept their list of trusted CA certificates as a single file. If the PEM-formatted certificate is missing its trailing newline character, the script will add one automatically when appending the certificate to
update-ca-certificates script will also run any scripts placed into
In case you have any
.dpkg-packaged version of Java installed, there will most likely be a script named
/etc/ca-certificates/update.d/jks-keystore dropped by the Java package, which will similarly update the Java keystore file at
/etc/ssl/certs/java/cacerts, so that it will also contain the exact same certificates as the OpenSSL CA certificate directory
/etc/ssl/certs or the file