2

We have a private certificate authority (CA) which is only used on sites in our intranet.

I can get the certificate easily:

openssl s_client -showcerts -connect atlas.sim.local:8443 </dev/null 2>/dev/null|openssl x509 -outform PEM >atlas.crt

I would like my debian devices to trust this certificate authority automatically. I have private apt repo, and all of my debian devices have packages from this repo installed. Therefore, I'd like this *.crt file to be deployed in this package.

The package will effectively do this:

install -Dm644 atlas.crt /usr/share/ca-certificates/sim.local/atlas.crt

But how do I regenerate the ca-certificates once this file is deployed? I'm looking for a file to deploy or a line I can run in postinst.

My first thought was simply:

/usr/sbin/update-ca-certificates

but man update-ca-certificates says:

update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt ...

It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that should be trusted.

For this to work, I need to ensure sim.local/atlas.crt is in /etc/ca-certificates.conf. Unfortunately there is no /etc/ca-certificates.conf.d/ which could allow me to drop-in another file with that content.

If I read /etc/ca-certificates.conf, it says:

# This file lists certificates that you wish to use or to ignore to be
# installed in /etc/ssl/certs.
# update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
#
# This is autogenerated by dpkg-reconfigure ca-certificates.

Therefore, I could try:

dpkg-reconfigure ca-certificates

But this causes an interactive dialog to show up which has my certificate de-selected by default. I'd rather this was non-interactive.

This is my current postinst. but I'm not sure that it's the right solution. Is there a right way to do this?

#!/bin/bash

set -e

case "$1" in
  configure)

    if [ -e /etc/ca-certificates.conf ] && 
      ! grep -q sim.local/atlas.crt /etc/ca-certificates.conf; then

        printf "%s\n" sim.local/atlas.crt >> /etc/ca-certificates.conf;
        /usr/sbin/update-ca-certificates;
    fi
  ;;
esac
Improve this question
4
  • 1
    Have you tried export DEBIAN_FRONTEND=noninteractive to do with noninteractive mode?
    – harshavmb
    Nov 20 at 14:16
  • 1
    I didn't know about that one. However calling dpkg-reconfigure from within postinst gives me: error: dpkg frontend lock was locked by another process...
    – Stewart
    Nov 20 at 14:24
  • which process held the lock?
    – harshavmb
    Nov 20 at 14:27
  • dpkg -i *.deb makes the lock. postinst is called from within that, which itself calls dpkg-reconfigure which fails to capture the lock. The parent process is the locking process.
    – Stewart
    Nov 20 at 15:32

2 Answers 2

Reset to default
2

From the same man page:

Furthermore all certificates with a .crt extension found below /usr/local/share/ca-certificates are also included as implicitly trusted.

That means you do not need to run dpkg-reconfigure - simply place the .crt file in /usr/local/share/ca-certificates, run updates-ca-certificates and you're done.

Improve this answer
6
  • I thought about that. /usr/local/ is meant for local administration and should normally be off-limits to the package manager. But maybe that is the easiest way. I'll try it out.
    – Stewart
    Nov 20 at 15:31
  • Define local :-) I'd suggest that you should be using local here as your package is site-specific, as opposed to Debian package maintainers who should not be using local. But that is just my thoughts - I can't find anything definitive.
    – garethTheRed
    Nov 20 at 15:39
  • @Stewart Yes, per Debian policy, it is forbidden for packages to install files into /usr/local. This directory is reserved for local changes by the admin.
    – xhienne
    Nov 20 at 17:30
  • @xhienne - my thinking is/was that while it most definitely forbidden for public packages to install into /usr/local, is a locally developed package the same? If the admin used Ansible (for example) to push the .crt file to /usr/local/share/ca-certificates then it would be perfectly acceptable. Does the fact that the admin uses a local package change things? In the end, there's no Debian Police to raid the site :-)
    – garethTheRed
    Nov 20 at 19:41
  • 1
    @garethTheRed The Debian police (lintian) is called at the end of package building and may output warning/errors. Of course you can probably ignore these but it's not quite neat, that would be like delivering sources that do not compile without warnings. My personal experience with Debian in general, and Debian packaging in particular, tells me to take the time to do it the right way, otherwise be prepared for a backlash sooner or later.
    – xhienne
    Nov 20 at 20:33
2

For this to work, I need to ensure sim.local/atlas.crt is in /etc/ca-certificates.conf. Unfortunately there is no /etc/ca-certificates.conf.d/ which could allow me to drop-in another file with that content.

Then add your CRT at the end of /etc/ca-certificates.conf manually:

echo sim.local/atlas.crt >> /etc/ca-certificates.conf

Finally, call update-ca-certificates.

Therefore, I could try:

dpkg-reconfigure ca-certificates

But this causes an interactive dialog to show up which has my certificate de-selected by default. I'd rather this was non-interactive.

Not if you set the priority of questions to "high" or above ("critical"):

dpkg-reconfigure -phigh ca-certificates

Anyway, I believe you should call update-ca-certificates, instead of dpkg-reconfigure-ing another package.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .