0

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the future. I have tried to automate adding and removing self-signed ca .pem files and noticed, that sometimes the .pem files reside in /etc/ssl/certs (debian), sometimes it reside in /usr/share/pki/trust or /etc/pki/trust (opensuse) and sometimes those dirs are empty or not existing.

Is there a common way or a command to add/remove ca-certificates on linux to the "official" openssl stack on a machine? If not, how can I find out the right place for ca-certificates or where (in which config-file) is the folder defined for openssl?

I know that this is only half of the route because some applications are using their own private ca-stack (curl?) but it helps a lot to have the self-signed ca-cert in a well known place.

Improve this question
1

2 Answers 2

Reset to default
1

Is there a common way or a command to add/remove ca-certificates on linux to the "official" openssl stack on a machine?

I can't find a proper duplicate but this has been answered before and the answer is:

No, distro's use different locations for openssl and after adding a CA certificate to openssl's CA collection, you still have to provide for applications that don't use openssl as a crypto library, but which use for instance Mozilla's NSS or GNU TLS, or Java applications that use a vault format.

Improve this answer
1
  • This is not the Answer I hoped for but it seems indeed that one of the pillows of internet security is secured by obscurity. The problem with NSS, GNU TLS and Java could be solved by calling the update-ca-certificate tool on many distributions but even this tool has not a standard behavior on different Distributions. Now it make sense to that firefox et al. uses their own set of ca-certificates.
    – user762353
    May 6, 2016 at 10:36
0

From http://gagravarr.org/writing/openssl-certs/others.shtml#ca-openssl

Another way to check On most OpenSSL builds, if you run the command openssl version -d it will report the directory used, eg OPENSSLDIR: "/usr/lib/ssl" (directory is /usr/lib/ssl). On some systems (eg Ubuntu), the path given from this will contain a symlink to the real certificates store elsewhere on the system, so you might want to double-check!

Improve this answer
1
  • No, this command will return the basefolder used by openssl; On opensuse e.g. it will return /etc/ssl, the certificates used by openssl are in /etc/ssl/certs which is linked to /var/lib/ca-certificates/pem. And those folder is filled by update-ca-certificate.But the source ca-certificate used by update-ca-certificate (and some clients like google-chrome) is /usr/share/pki/trust
    – user762353
    May 4, 2016 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .