I know it has been already asked, but despite many hours of research I couldn't find a working solution. I am trying to install my root certificate in my server, so internal service can bind to each other using SSL.

What should know about the new root CA:

  1. Apache httpd and PHP
  2. OpenLDAP client
  3. Node.js

For Apache I need a PHP application to know about the root certificate, so if a site connects to another SSL website (signed by the same CA) it works fine and it doesn't complain about a self-signed certificate.

For OpenLDAP I believe it's the same as PHP, the module it uses is quite old, it's Net_LDAP2, installed with PEAR. I tried editing the local openldap configuration, but it looks like the system is not using it.

Last Node.js, which I use for parsoid. The node.js servers have to trust the CA in order to make a good SSL connection.

I tried adding the certificate to /etc/pki/tls/certs/ca-bundle.crt with little success.

While httpd doesn't see the root CA, I managed to make other services work with it, like tomcat and 389.

Thank you for your support.

  • 1
    This almost needs to be three separate questions. I could be wrong though, perhaps there is a system wide method to trust a CA cert for all those services. If there isn't a system wide method, then having this broken out as three separate questions may be necessary to get useful answers. – Zoredache Dec 5 '13 at 21:40
  • What exactly have you tried? This is pretty easily researched stuff as it is pretty commonly done. If we know why you are having trouble, we might be able to give a better answer than SSLCACertificateFile in /etc/httpd/conf.d/ssl.conf, TLS_CACERT in /etc/openldap/ldap.conf (OpenLDAP Client), TLSCACertificateFile in /etc/openldap/slapd.conf (OpenLDAP Server), etc.. – Aaron Copley Dec 5 '13 at 22:18
  • Apache httpd is the main reason why I posted this question. I think it reads system-wide certificates. But editing them didn't work. – John White Dec 6 '13 at 12:33
up vote 7 down vote accepted

On my RHEL 6 box the man 8 update-ca-trust manual page has a pretty extensive explanation on how the system-wide CA certificates and associated trusts can/should be managed.

More often then not configuration is application specific as the comments above indicate.

  • 2
    No such manual for CentOS. I believe the two systems have different admin tools. – John White Dec 6 '13 at 12:35
  • They're mostly alike but it's small differences like that that always trip my up. It's part of the ca-certificates rpm. A copy of the man page can be found here – HBruijn Dec 6 '13 at 12:45
  • My CentOS 6.5 has man page for update-ca-trust. @Mc120k do you have ca-certificates-2013 installed? – 8None1 Jun 1 '14 at 19:28
  • Found now. Thanks – John White Nov 2 '14 at 16:37

I wrote some command lines so it is more accessible to novice in SSL:

Navigate to the PKI Folder

$ cd /etc/pki/tls/certs/
 

VERIFY (hard) links and Backup certificates

$ cp ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.bak
$ cp ca-bundle.trust.crt /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt.bak
 

Upload CA chain to CentOS

$ scp <cachain> root@sydapp28:/tmp 
 

Connect to CentOS via SSH (Putty?) or local

$ ssh -C root@sydapp28
 

IF PKCS12 CAChain: “Convert your Internal CA chain certificate to PEM format & remove headers”:

$ cd /tmp ; openssl pkcs12 -nodes -in <cachain.pfx.p12> | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cachain.pem
 

Append your Internal CA to CentOS

$ cat /tmp/cachain.pem >> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
$ cat /tmp/cachain.pem >> /etc/pki/ca-trust/extracted/pem/ca-bundle.trust.crt
$ reboot

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.