Home / ubuntu / Questions / 1024300
In Process
Enrique Moreno Tent
Asked: 2018-04-13 00:49:13 +0800 CST

Set company certificate as Trusted

  • 772

My company gave me a file company_CA.crt that I need to use to access one of our customers website.

When I tried to add it on macOS, all I had to do was to click on the file, and then after imported, set it as "Always Trust".

I would like to do the same in Ubuntu, so I followed the next steps:

  • Copied the CRT file to usr/local/share/ca-certificates/my_company
  • Run sudo update-ca-certificates

But I cannot still open the website. Did I miss a step?

ssl certificates

1 Answers

    • Check if the CA root certificate for your customer_web_site is known or not in your system.

      $ curl -I  https://customer_web_site
curl: (77) Problem with the SSL CA cert (path? access rights?)

    The CA certificate for customer_web_site server is (indeed) NOT known in the system.

    File company_CA.crt must be in CRT format. (seems to be in this case) If it is in PEM format, then you have to conver it (openssl x509 -in xxxx.pem -inform PEM -out xxxx.crt

    • Install the CA file in Ubuntu

    Copy the company_CA.crt file to new directory extra in /usr/share/ca-certificates

    Let ubuntu pick-up that new CA certificate and install it in the Linux system

    sudo dpkg-reconfigure ca-certificates

    A menu will appear. Check option "ask" for Prompt for each new CA certificate. You will see your new certificate.

    extra/company_CA.crt

    Press space, to select that new CA certificate file and select OK.

    uAt the end, you should see something like this:

    1 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d...

    Check if curl works without specifying the CA certificate file

    $ curl -I https://customer_web_site
HTTP/1.1 200 OK
Date: Thu, 06 Sep 2018 18:08:26 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Fri, 27 Jul 2018 12:09:02 GMT
ETag: "2c39-571f9fa3671da"
Accept-Ranges: bytes
Content-Length: 11321
Vary: Accept-Encoding
Content-Type: text/html

    It works.

    If you want to know more about Self Signed Certificates and how to use them, then check my github.

    • 4