Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few Redhat 6 servers that are unable to verify the certificate of an HTTPS site. I have checked, and they don't appear to have a very current CA bundle. The file /etc/pki/tls/certs/ca-bundle.crt was last modified in 2010. I checked which package is responsible for updating this file by doing rpm -qf /etc/pki/tls/certs/ca-bundle.crt, and it appears that it is part of ca-certificates package. I tried yum install ca-certificates, and the latest version is already installed. Is there a package available for Redhat 6 that contains a newer CA bundle?

share|improve this question
up vote 0 down vote accepted

There isn't. I recommend using and making an rpm (easily done with fpm) or distributing it with your configuration management system.

share|improve this answer
Thanks! I have done what you recommended, but it just seems odd that this is not better managed by the system updates. – Curt Mar 14 '13 at 6:19

Since Mark's answer was posted, we (RH) have started updating the distribution bundle more proactively, and introduced an improved system for managing the trust store. There were updates to RHEL 6's ca-certificates in October and December of 2013, and in July and August of 2014, and further updates will be made when appropriate. See man update-ca-trust for details of the new system, after updating to the latest version of the package.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.