How do I install a root certificate?

Question

Can anyone point me to a good tutorial on installing a root certificate on Ubuntu?

I've been provided with a .crt file. I gather that need to create a directory at /usr/share/ca-certificates/newdomain.org and place the .crt in that directory. Beyond that I'm not sure how to proceed.

score 516 · Accepted Answer · edited Apr 05 '25 at 12:55

Given a CA certificate file foo.crt, follow these steps to install it on Ubuntu:

Create a directory for extra CA certificates in /usr/local/share/ca-certificates:
```
sudo mkdir /usr/local/share/ca-certificates/extra
```
Copy the CA .crt file to this directory:
```
sudo cp foo.crt /usr/local/share/ca-certificates/extra/foo.crt
```
(For Ubuntu 20.04 or higher the path is /usr/share/ca-certificates/extra/foo.crt)
Let Ubuntu add the .crt file's path relative to /usr/local/share/ca-certificates to /etc/ca-certificates.conf:
```
sudo dpkg-reconfigure ca-certificates
```
To do this non-interactively, run:
```
sudo update-ca-certificates
```

In case of a .pem file on Ubuntu, it must first be converted to a .crt file:

openssl x509 -in foo.pem -inform PEM -out foo.crt

Or a .cer file can be converted to a .crt file:

openssl x509 -inform DER -in foo.cer -out foo.crt

score 275 · Answer 2 · edited Nov 04 '16 at 12:53

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu:

First, copy your CA to dir /usr/local/share/ca-certificates/

sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt

then, update CA store

sudo update-ca-certificates

That's all. You should get this output:

Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:foo.pem
done.
done.

No file is needed to edit. Link to your CA is created automatically.

Please note that the certificate filenames have to end in .crt, otherwise the update-ca-certificates script won't pick up on them.

This procedure works also in newer versions: manuals.

score 29 · Answer 3 · edited Mar 22 '25 at 18:00

Clarification between update-ca-certificates and dpkg-reconfigure ca-certificates and why one works and the other does not!!

update-ca-certificates or sudo update-ca-certificates will only work if /etc/ca-certificates.conf has been updated.
/etc/ca-certificate.conf is only updated once you ran dpkg-reconfigure ca-certificates which updates the certificate names to be imported into /etc/ca-certificates.conf.

This is stated in the header of the /etc/ca-certificates.conf file:

# This file lists certificates that you wish to use or to ignore to be
# installed in /etc/ssl/certs.
# update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
#
# This is autogenerated by dpkg-reconfigure ca-certificates.  <=======
# Certificates should be installed under /usr/share/ca-certificates
# and files with extension '.crt' is recognized as available certs.
#
# line begins with # is comment.
# line begins with ! is certificate filename to be deselected.
#
mozilla/ACCVRAIZ1.crt
mozilla/AC_RAIZ_FNMT-RCM.crt
mozilla/Actalis_Authentication_Root_CA.crt
mozilla/AddTrust_External_Root.crt
...

As you can see, the format in /etc/ca-certificates.conf is <folder name>/<.crt name>

So in order to use update-ca-certificates or sudo update-ca-certificates you could do the following to import a .crt:

Create a directory for extra CA certificates in /usr/share/ca-certificates:
```
sudo mkdir /usr/share/ca-certificates/extra
```

Copy the .crt file to this directory:

sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt

Append a line to /etc/ca-certificates.conf using <folder name>/<.crt name>:
```
echo "extra/foo.crt" | sudo tee -a /etc/ca-certificates.conf
```

Update certs non-interactively with sudo update-ca-certificates:

$ sudo update-ca-certificates
...
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.

score 14 · Answer 4 · edited Oct 13 '18 at 21:11

Install a Certificate Authority on Ubuntu

I have tested this on Ubuntu 14.04.

Here is my solution, I looked and looked for a long time trying to figure out how to get this to work.

Extract the .cer from browser. I used IE 11.
- Settings -> Internet Options -> Intermediate Certificate Authorities
- Select The Certificate Authority You Want To Export (certutil -config - -ping will show you the ones you are using if you are behind a corporate proxy)
- Export -> Select The Format You Want To Use: DER Encoded .cer
Get the .cer files to Ubuntu somehow
Convert to .crt openssl x509 -inform DER -in certificate.cer -out certificate.crt
Make extra directory sudo mkdir /usr/share/ca-certificates/extra
Copy certificates over sudo cp certificate.crt /usr/share/ca-certificates/extra/certificate.crt
sudo update-ca-certificates
If not, then you have to do what I did, go to sudo nano /etc/ca-certificates.conf
Scroll down and find your .cer and remove the ! from in front of the file name (update-ca-certificates doc) - if you don't find your certificate run dpkg-reconfigure ca-certificates
Run sudo update-ca-certificates
You may need to individually trust the CAs from Firefox, Chrome, etc.. , I needed it to work with Docker so after these steps it worked with Docker.

score 4 · Answer 5 · edited May 14 '19 at 21:52

4

Other answers didn't work for me with Ubuntu 18.04. Append the certificate cert to /etc/ssl/certs/ca-certificates.crt using the following command:

cat YOUR_CERT_HERE.crt >> /etc/ssl/certs/ca-certificates.crt

edited May 14 '19 at 21:52

mahatmanich

699

answered Nov 06 '18 at 21:34

Jasmit Tarang

49

score 3 · Answer 6 · edited Jun 29 '12 at 09:45

Have the (root / CA) certificate available on a web server, local to your network if you like.

Browse to it with Firefox.
Open the cert and tell Firefox to add it as an exception.
Firefox will ask you whether you want to trust this certificate for identifying websites, for e-mail users or for software publishers.
Enjoy!

Update: It will be necessary to check if this works on Ubuntu 11. I've realised that I just did this on Ubuntu 12.04 LTS.

score 2 · Answer 7 · answered May 17 '19 at 11:07

Here are the simple steps:

Install CA certificates to allow SSL-based applications to check for the authenticity of SSL connections:
```
sudo apt-get install ca-certificates
```
Copy certificate file (crt or .cer) into /usr/local/share/ca-certificates/ folder, e.g.:
```
sudo cp file.crt /usr/local/share/ca-certificates/
```
For PEM file, see: Convert .pem to .crt and .key.

Optionally, if using Charles proxy, this command can work:
```
curl -L chls.pro/ssl | sudo tee /usr/local/share/ca-certificates/charles.crt
```
Update certificates:
```
sudo update-ca-certificates
```
The command will update /etc/ssl/certs directory to hold SSL certificates and generates ca-certificates.crt file (a concatenated single-file list of certificates).

Note: Don't add certificates manually (as suggested here), as they are not persistent and going to be removed.

^{Note: If you're running as root, you can drop the sudo from the above commands.}

score 1 · Answer 8 · answered Mar 29 '18 at 21:26

To add a Root CA certificate in FireFox is now-a-days very easy. Just open preferences, go to "Privacy & Security", scroll down to "Certificates" and click "View Certificates...". Here you can click "Import Certificate". Point to your root CA (.pem) and OK. That's all folks.

score 1 · Answer 9 · answered Oct 28 '11 at 18:05

From here:

Installing the Certificate

You can install the key file example.key and certificate file example.crt, or the certificate file issued by your CA, by running following commands at a terminal prompt:

sudo cp example.crt /etc/ssl/certs
sudo cp example.key /etc/ssl/private

Now simply configure any applications, with the ability to use public-key cryptography, to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can provide IMAPS and POP3S, etc.

How do I install a root certificate?

9 Answers9

Install a Certificate Authority on Ubuntu

Installing the Certificate

Linked