189

Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem?

Improve this question

6 Answers 6

Reset to default
140

For system-wide use, OpenSSL should provide you /etc/ssl/certs and /etc/ssl/private. The latter of which will be restricted 700 to root:root.

If you have an application that doesn’t perform initial privilege separation from root, then it might suit you to locate them somewhere local to the application with the relevantly restricted ownership and permissions.

Improve this answer
8
  • 5
    is this standardized somewhere? The file system hierarchy standard doesn't contain it.
    – cweiske
    Dec 4, 2013 at 20:50
  • 3
    @cweiske This seems to be historical OpenSSL convention, not formally standardized, and a very unwieldy one in my opinion. My earliest trace is this version: rpm.pbone.net/index.php3/stat/4/idpl/38501/dir/redhat_other/com/…
    – kubanczyk
    Apr 2, 2015 at 21:20
  • 10
    Worth noting that this is only Debian based distros.
    – Joshua Griffiths
    Sep 16, 2015 at 8:23
  • 3
    Arch and CentOS also stores ca certs in /etc/ssl/certs as far as I can see
    – theferrit32
    Feb 15, 2019 at 4:58
  • 4
    This is not correct. /etc/ssl/certs is for root certs. Don’t store your server certs there.
    – chmike
    Oct 23, 2020 at 12:37
120

This is where Go looks for public root certificates:

"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
"/etc/pki/tls/cacert.pem",                           // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
"/etc/ssl/cert.pem",                                 // Alpine Linux

Also:

"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs",       // FreeBSD
"/etc/pki/tls/certs",           // Fedora/RHEL
"/etc/openssl/certs",           // NetBSD
"/var/ssl/certs",               // AIX
Improve this answer
1
  • Are intermediate certs store in the same folder as Root CA certs ?
    – SebMa
    Jun 1 at 16:41
22

This will vary from distribution to distribution. For example, on Amazon Linux instances (based on RHEL 5.x and parts of RHEL6, and compatible with CentOS), the certificates are stored in /etc/pki/tls/certs and the keys are stored in /etc/pki/tls/private. The CA certificates have their own directory, /etc/pki/CA/certs and /etc/pki/CA/private. For any given distribution, especially on hosted servers, I recommend to follow the already-available directory (and permissions) structure, if one is available.

Improve this answer
1
  • 2
    Same for CentOS7 as well, thank you.
    – Jacob Evans
    Jan 13, 2017 at 15:42
9

Ubuntu uses /etc/ssl/certs. It also has the command update-ca-certificates which will install certificates from /usr/local/share/ca-certificates.

So installing your custom certificates in /usr/local/share/ca-certificates and running update-ca-certificates seems to be recommended.

http://manpages.ubuntu.com/manpages/latest/man8/update-ca-certificates.8.html

Improve this answer
1
  • 3
    /etc/ssl/certs is for root certs. That’s not the place to store a server certificate.
    – chmike
    Oct 23, 2020 at 12:39
0

Great answers so far, thanks, all! But since 2009, free SSL cert systems like LetsEncrypt have become the standard, and the modern config is a tad more complicated.

LetsEncrypt has three directories, for archiving, active, and renewal for SSL-enabled domains, check them here:

/etc/letsencrypt/archive/example.com
/etc/letsencrypt/live/example.com
/etc/letsencrypt/renewal/example.com.conf

Apache2 has two directories, for enabled and available SSL-enabled domains, check them here:

/etc/apache2/sites-enabled/example.com-le-ssl.conf
/etc/apache2/sites-available/example.com-le-ssl.conf

LetsEncrypt Archives eventually get moved to another directory, check it here:

/var/lib/letsencrypt/backups/[TIMESTAMP]/example.com-le-ssl.conf_0
Improve this answer
-2

If you are looking for a certificate used by your Tomcat instance

  1. Open the server.xml file
  2. Search for SSL/TLS connector
  3. See keystoreFile attribute that contains the path to keystore file.

It looks like

<Connector
    protocol="org.apache.coyote.http11.Http11Protocol"
    port="8443" maxThreads="200"
    scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="${user.home}/.keystore" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS" />
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .