We have a private certificate authority (CA) which is only used on sites in our intranet.
I can get the certificate easily:
openssl s_client -showcerts -connect atlas.sim.local:8443 </dev/null 2>/dev/null|openssl x509 -outform PEM >atlas.crt
I would like my debian devices to trust this certificate authority automatically. I have private
apt repo, and all of my debian devices have packages from this repo installed. Therefore, I'd like this
*.crt file to be deployed in this package.
The package will effectively do this:
install -Dm644 atlas.crt /usr/share/ca-certificates/sim.local/atlas.crt
But how do I regenerate the ca-certificates once this file is deployed? I'm looking for a file to deploy or a line I can run in
My first thought was simply:
man update-ca-certificates says:
update-ca-certificatesis a program that updates the directory
/etc/ssl/certsto hold SSL certificates and generates
It reads the file
/etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under
/usr/share/ca-certificatesthat should be trusted.
For this to work, I need to ensure
sim.local/atlas.crt is in
/etc/ca-certificates.conf. Unfortunately there is no
/etc/ca-certificates.conf.d/ which could allow me to drop-in another file with that content.
If I read
/etc/ca-certificates.conf, it says:
# This file lists certificates that you wish to use or to ignore to be # installed in /etc/ssl/certs. # update-ca-certificates(8) will update /etc/ssl/certs by reading this file. # # This is autogenerated by dpkg-reconfigure ca-certificates.
Therefore, I could try:
But this causes an interactive dialog to show up which has my certificate de-selected by default. I'd rather this was non-interactive.
This is my current
postinst. but I'm not sure that it's the right solution. Is there a right way to do this?
#!/bin/bash set -e case "$1" in configure) if [ -e /etc/ca-certificates.conf ] && ! grep -q sim.local/atlas.crt /etc/ca-certificates.conf; then printf "%s\n" sim.local/atlas.crt >> /etc/ca-certificates.conf; /usr/sbin/update-ca-certificates; fi ;; esac