89 votes
Accepted

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. ...
derobert's user avatar
  • 109k
83 votes
Accepted

How to export CA certificate chain from PFX in PEM format without bag attributes

The solution I finally came to was to pipe it through sed. openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key> ...
BryKKan's user avatar
  • 2,147
78 votes

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN ...
estani's user avatar
  • 973
45 votes
Accepted

Is it possible to have APT accept an "invalid" certificate?

You can configure certain parameters for the HTTPS transport in /etc/apt/apt.conf.d/ — see man apt.conf (section "THE ACQUIRE GROUP", subsection "https") for details. There is also a helpful example ...
n.st's user avatar
  • 8,118
43 votes
Accepted

Create self-signed certificate with end-date in the past

You have two ways of creating certificates in the past. Either faking the time (1)(2), or defining the time interval when signing the certificate (3). 1) Firstly, about faking the time: to make one ...
Rui F Ribeiro's user avatar
40 votes
Accepted

How do I fix wget on an HTTP url not trusted errors in kali?

If you are using Debian or Ubuntu, install the ca-certificates package: $ sudo apt-get install ca-certificates If you don't care about checking the validity of the certificate, use the --no-check-...
Rakib's user avatar
  • 2,435
33 votes

Do I Need to Restart Nginx if I Renew My Security Certificate(s)?

On receiving SIGHUP nginx will reload updated configuration, verify it while opening log files and reading SSL certificates, then gracefully shut down worker processes relying on previous ...
sanmai's user avatar
  • 1,416
33 votes
Accepted

Using `openssl` to display all certificates of a PEM file

The openssl command (specifically, its openssl x509 subcommand, among others) is polite with its data stream: once it reads data, it doesn't read more than it needs. This allows to chain multiple ...
A.B's user avatar
  • 35.4k
28 votes

Installing certificates on arch

Use the trust command provided by the p11-kit package: sudo trust anchor --store ~/my-ca-cert.crt
404 Not Found's user avatar
24 votes

Is it possible to have APT accept an "invalid" certificate?

For a temporary solution you can do: apt -o "Acquire::https::Verify-Peer=false" update apt -o "Acquire::https::Verify-Peer=false" install curl
mr.wolle's user avatar
  • 341
24 votes

How to export CA certificate chain from PFX in PEM format without bag attributes

Another solution without sed: openssl pkcs12 -in <filename.pfx> -nocerts -nodes | openssl pkcs8 -nocrypt -out <clientcert.key> openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | ...
Rockallite's user avatar
21 votes
Accepted

How do I install a system-wide SSL certificate on openSUSE?

As already mentioned SUSE supports ca-certificates starting with openSUSE 13.1 / SLES 12. The difference to debian/Ubuntu is the directory for your certififcates. The SLES man page to update-ca-...
Christian's user avatar
  • 1,581
20 votes
Accepted

update-ca-trust extract not adding certificates to ca-bundle

TL;DR The update-ca-trust won't extract your certificate file to the ca-bundle.crt unless this succeeds: openssl x509 -noout -text -in <cert_file> | grep --after-context=2 "X509v3 Basic ...
Yuri's user avatar
  • 458
18 votes
Accepted

Adding a root certification authority to a java application

Simply copy your certificate files to this directory on CentOS 7.x: $ sudo cp <cert file> /etc/pki/ca-trust/source/anchors/ Once the certificate files put into this directory, run this command ...
slm's user avatar
  • 369k
17 votes

Using `openssl` to display all certificates of a PEM file

Seems like PEM format is not handled very well with more than one certificate. Based on this answer: openssl crl2pkcs7 -nocrl -certfile cert.pem | openssl pkcs7 -print_certs -text -noout it first ...
Romeo Ninov's user avatar
  • 17.3k
16 votes
Accepted

Arch linux ca-certificates.crt not found

I am posting an answer to my own question because I solved the problem and I did not find a valid solution elsewhere. There is no /etc/ssl/certs/ca-certificate-crt file. So a link needs to be provided ...
pianomanfrazier's user avatar
15 votes
Accepted

How do I list all available SSL CA certificates on CentOS 6?

// , Use the openssl command to get output from /etc/ssl/certs/ca-bundle.crt Anyway, I tried the following, mostly copied from https://unix.stackexchange.com/a/97249/48498, and it seemed to work if I ...
Nathan Basanese's user avatar
15 votes

Generating duplicate certificates with OpenSSL CA

In the same folder as your database (the index.txt file) create a file index.txt.attr and add the following: unique_subject = no If you're unsure where your database file is located, check the ...
garethTheRed's user avatar
  • 33.8k
14 votes

Adding a self-signed certificate to the "trusted list"

Fedora On Fedora 23, add the .pem or .der file to /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract. See man update-ca-trust for details, e.g. whether to use /etc or /usr. Alpine ...
user7610's user avatar
  • 1,988
13 votes

Apache: I have lost my private.key, is it possible to re-create it from certificate.crt?

No, it is not possible to generate the private.key file from the certificate.crt file. You will need to generate a new key and a new certificate, if the below does not apply to you. You may ask your ...
John's user avatar
  • 17k
12 votes

How to permanently add self-signed certificate in Firefox?

Easy URL to test: https://self-signed.badssl.com/ There are two ways: toggle Firefox to set server certificates added as Lifetime Permanent by default in about:config toggle security.certerrors....
A.B's user avatar
  • 35.4k
11 votes

Unable to locally verify the issuer's authority

I was having a similar error with https://excellmedia.dl.sourceforge.net/project/astyle/astyle/astyle%203.0.1/astyle_3.0.1_linux.tar.gz on a docker image(circleci/jdk8:0.1.1), In my case upgrading ca-...
Harsh Kumar Bhartiya's user avatar
11 votes
Accepted

The correct way of implementing SSL on localhost

Warning: Before you dive into the minefield of running your own Certification Authority, you may need to study the security implications! But if you must, read on for a quick and dirty CA that will ...
garethTheRed's user avatar
  • 33.8k
11 votes

how to make Gnu/Linux trust a certificate that's trusted by Windows out-of-the-box?

The real fix for this is to ensure that your server presents all certificates in the chain and not just the end-entity (server) certificate. Point your server administrator to RFC 5246 Section 7.4.2 ...
garethTheRed's user avatar
  • 33.8k
11 votes
Accepted

How to add a local CA authority on an air-gapped host of Debian

Create a directory under /usr/local/share/ca-certificates with the name of your choosing, and place the public CA certificate of your CA server into it in PEM format, as a *.crt file. Then run update-...
telcoM's user avatar
  • 94.5k
10 votes

Adding a self-signed certificate to the "trusted list"

In centos: cp *.pem /etc/pki/ca-trust/source/anchors/ update-ca-trust extract
dragonfly's user avatar
  • 101
10 votes

Create self-signed certificate with end-date in the past

I'm almost surprised to find that the obvious thing works: whereas openssl takes as an argument the number of days for which the certificate should be valid, just supply a negative number! openssl ...
Celada's user avatar
  • 44k
10 votes
Accepted

CA certificates location in Ubuntu 18.04

Should be /etc/ssl/certs/ or /etc/ssl/certs/ca-certificates.crt. http://manpages.ubuntu.com/manpages/bionic/man8/update-ca-certificates.8.html Note this store is not necessarily used consistently by ...
sourcejedi's user avatar
  • 49.9k
9 votes

script to check if SSL certificate is valid

If you need to check expiry date, thanks to this blog post, found a way to find this information with other relevant information with a single call: echo | openssl s_client -servername unix....
Robert Lujo's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible