90
votes
Accepted
How to extract the Root CA and Subordinate CA from a certificate chain in Linux?
From a web site, you can do:
openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null
That will show the certificate chain and all the certificates the server presented.
...
- 111k
86
votes
Accepted
How to export CA certificate chain from PFX in PEM format without bag attributes
The solution I finally came to was to pipe it through sed.
openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key>
...
- 2,187
84
votes
How to extract the Root CA and Subordinate CA from a certificate chain in Linux?
tl;dr - one liner bash magic to dump all certs in the chain
openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null |
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN ...
- 1,033
51
votes
Accepted
Using `openssl` to display all certificates of a PEM file
The openssl command (specifically, its openssl x509 subcommand, among others) is polite with its data stream: once it reads data, it doesn't read more than it needs.
This allows to chain multiple ...
- 37.5k
48
votes
Accepted
Is it possible to have APT accept an "invalid" certificate?
You can configure certain parameters for the HTTPS transport in /etc/apt/apt.conf.d/ — see man apt.conf (section "THE ACQUIRE GROUP", subsection "https") for details.
There is also a helpful example ...
- 8,198
45
votes
Accepted
Create self-signed certificate with end-date in the past
You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3).
1) Firstly, about faking the time: to make one ...
- 57.1k
41
votes
Accepted
How do I fix wget on an HTTP url not trusted errors in kali?
If you are using Debian or Ubuntu, install the ca-certificates package:
$ sudo apt-get install ca-certificates
If you don't care about checking the validity of the certificate, use the --no-check-...
- 2,465
33
votes
Do I Need to Restart Nginx if I Renew My Security Certificate(s)?
On receiving SIGHUP nginx will reload updated configuration, verify it while opening log files and reading SSL certificates, then gracefully shut down worker processes relying on previous ...
- 1,436
29
votes
Installing certificates on arch
Use the trust command provided by the p11-kit package:
sudo trust anchor --store ~/my-ca-cert.crt
- 391
26
votes
Is it possible to have APT accept an "invalid" certificate?
For a temporary solution you can do:
apt -o "Acquire::https::Verify-Peer=false" update
apt -o "Acquire::https::Verify-Peer=false" install curl
- 361
26
votes
How to export CA certificate chain from PFX in PEM format without bag attributes
Another solution without sed:
openssl pkcs12 -in <filename.pfx> -nocerts -nodes | openssl pkcs8 -nocrypt -out <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | ...
- 421
22
votes
Accepted
update-ca-trust extract not adding certificates to ca-bundle
TL;DR
The update-ca-trust won't extract your certificate file to the ca-bundle.crt unless this succeeds:
openssl x509 -noout -text -in <cert_file> | grep --after-context=2 "X509v3 Basic ...
- 478
19
votes
Accepted
Adding a root certification authority to a java application
Simply copy your certificate files to this directory on CentOS 7.x:
$ sudo cp <cert file> /etc/pki/ca-trust/source/anchors/
Once the certificate files put into this directory, run this command ...
slm♦
- 373k
19
votes
Using `openssl` to display all certificates of a PEM file
Seems like PEM format is not handled very well with more than one certificate. Based on this answer:
openssl crl2pkcs7 -nocrl -certfile cert.pem | openssl pkcs7 -print_certs -text -noout
it first ...
- 18.1k
16
votes
Accepted
Arch linux ca-certificates.crt not found
I am posting an answer to my own question because I solved the problem and I did not find a valid solution elsewhere. There is no /etc/ssl/certs/ca-certificate-crt file. So a link needs to be provided ...
- 251
15
votes
Accepted
How do I list all available SSL CA certificates on CentOS 6?
// , Use the openssl command to get output from /etc/ssl/certs/ca-bundle.crt
Anyway, I tried the following, mostly copied from https://unix.stackexchange.com/a/97249/48498, and it seemed to work if I ...
- 419
15
votes
Generating duplicate certificates with OpenSSL CA
In the same folder as your database (the index.txt file) create a file index.txt.attr and add the following:
unique_subject = no
If you're unsure where your database file is located, check the ...
- 34.3k
13
votes
Unable to locally verify the issuer's authority
I was having a similar error with https://excellmedia.dl.sourceforge.net/project/astyle/astyle/astyle%203.0.1/astyle_3.0.1_linux.tar.gz on a docker image(circleci/jdk8:0.1.1),
In my case upgrading ca-...
13
votes
Apache: I have lost my private.key, is it possible to re-create it from certificate.crt?
No, it is not possible to generate the private.key file from the certificate.crt file. You will need to generate a new key and a new certificate, if the below does not apply to you.
You may ask your ...
- 17.1k
13
votes
How to permanently add self-signed certificate in Firefox?
Easy URL to test: https://self-signed.badssl.com/
There are two ways:
toggle Firefox to set server certificates added as Lifetime Permanent by default
in about:config toggle security.certerrors....
- 37.5k
12
votes
Accepted
How to add a local CA authority on an air-gapped host of Debian
Create a directory under /usr/local/share/ca-certificates with the name of your choosing, and place the public CA certificate of your CA server into it in PEM format, as a *.crt file. Then run update-...
- 102k
11
votes
Accepted
The correct way of implementing SSL on localhost
Warning: Before you dive into the minefield of running your own Certification Authority, you may need to study the security implications!
But if you must, read on for a quick and dirty CA that will ...
- 34.3k
11
votes
Accepted
CA certificates location in Ubuntu 18.04
Should be /etc/ssl/certs/ or /etc/ssl/certs/ca-certificates.crt.
http://manpages.ubuntu.com/manpages/bionic/man8/update-ca-certificates.8.html
Note this store is not necessarily used consistently by ...
- 51.4k
11
votes
how to make Gnu/Linux trust a certificate that's trusted by Windows out-of-the-box?
The real fix for this is to ensure that your server presents all certificates in the chain and not just the end-entity (server) certificate.
Point your server administrator to RFC 5246 Section 7.4.2 ...
- 34.3k
10
votes
Adding a self-signed certificate to the "trusted list"
In centos:
cp *.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust extract
- 101
10
votes
Create self-signed certificate with end-date in the past
I'm almost surprised to find that the obvious thing works: whereas openssl takes as an argument the number of days for which the certificate should be valid, just supply a negative number!
openssl ...
- 44.7k
9
votes
script to check if SSL certificate is valid
If you need to check expiry date, thanks to this blog post, found a way to find this information with other relevant information with a single call:
echo | openssl s_client -servername unix....
- 191
9
votes
Adding a self-signed certificate to the "trusted list"
Non Interactive Approach (Oct'18)
for recent debian based systems
There's a distinction between adding a cert to the host's store and activating it so that applications really utilize those. An ...
- 211
9
votes
Accepted
OfflineIMAPS and CA certificates
At some point in the not-too-distant-past, offlineimap started verifying SSL certificates (yes, it wasn't before apparently). Rather than do the sensible thing, and use the default system trust store ...
- 378
Only top scored, non community-wiki answers of a minimum length are eligible