Install a root CA certificate in the trust store

Enterprise environments sometimes have a local Certificate Authority (CA) that issues certificates for use within the organisation. For an Ubuntu server to be functional, and to trust the hosts in this environment, this CA must be installed in Ubuntu’s trust store.

Certificate formats

There are two encoding formats for certificates:

  • Privacy Enhanced Mail (PEM): These are human-readable and in Base64-encoded ASCII format.

  • Distinguished Encoding Rules (DER): These are encoded in a more compact binary format, and not human readable.

To install a certificate in the trust store it must be in PEM format. A PEM certificate starts with the line ----BEGIN CERTIFICATE----. If you see this, you’re ready to install. If not, it is probably a DER certificate and needs to be converted before you can install it in the trust store.

Install a PEM-format certificate

Assuming your PEM-formatted root CA certificate is in local-ca.crt, run the following commands to install it:

  • Generate a random certificate

Answer the questions asked after executing the command. When asked to input a commonName (CN), it should match the hostname of the server.

openssl req -x509 -new -nodes -keyout local-ca.key -out local-ca.crt

  • Install the CA certificate package

sudo apt-get install -y ca-certificates

  • Copy your certificate to the local CA certificates directory

sudo cp local-ca.crt /usr/local/share/ca-certificates

  • Add the certificate to your trust store

sudo update-ca-certificates

  • Verify that your certificate is in pem format

$ sudo ls /etc/ssl/certs/ | grep local-ca

local-ca.pem

  • You can also verify that your certificate is available in the trust store by selecting a few texts from your certificate and comparing them with the certificate at the end of the trust store file to see if it matches yours.

$ sudo cat local-ca.crt

...
L4zOd3b41xJtYldofPve
-----END CERTIFICATE-----

$ sudo cat /etc/ssl/certs/ca-certificates.crt | grep L4zOd3b41xJtYldofPve

L4zOd3b41xJtYldofPve

Note

It is important that the certificate file has the .crt extension, otherwise it will not be processed.

After this point, you can use tools like curl and wget to connect to local sites.

Uninstall a PEM-format certificate

  • Verify that the certificate you’d like to uninstall exists.

$ sudo ls /usr/local/share/ca-certificates/local-ca.crt

/usr/local/share/ca-certificates/local-ca.crt

  • Delete the certificate

sudo rm /usr/local/share/ca-certificates/local-ca.crt

  • The certificate still exists in the trust store.

$ sudo cat /etc/ssl/certs/ca-certificates.crt | grep L4zOd3b41xJtYldofPve

L4zOd3b41xJtYldofPve

  • Update the trust store

$ sudo update-ca-certificates --fresh

  • Verify that the certificate has been uninstalled

$ sudo cat /etc/ssl/certs/ca-certificates.crt | grep L4zOd3b41xJtYldofPve

Convert from DER to PEM format

You can convert a DER-formatted certificate called local-ca.der to PEM form like this:

sudo openssl x509 -inform der -outform pem -in local-ca.der -out local-ca.crt`

The CA trust store location

The CA trust store (as generated by update-ca-certificates) is available at the following locations:

  • As a single file (PEM bundle) in /etc/ssl/certs/ca-certificates.crt

  • As an OpenSSL-compatible certificate directory in /etc/ssl/certs