I am fairly new to this but I've done some internet research the last 2 days and I couldn't find an suitable answer.

I have been given a ca-certificate chain (cacertchain.crt) which I need to import to a server running RHEL7 (no GUI). The server has the ca-bundle.crt file. I have tried to put cacertchain.crt to /etc/pki/ca-trust/source/anchors/ and run update-ca-trust and update-ca-trust extract but I couldn't see any changes to the ca-bundle.crt file.

So my question: is there a way of importing a ca-certificate chain (.crt) to RHEL7 keystore?

The certificate chain (cacertchain.crt) includes:

Root Certificate Subject CN - VeriSign Class 3 Public Primary Certification Authority - G5 (I believe this is already available in ca-bundle.crt)

Intermediate Certificate Subject CN - Symantec Class 3 EV SSL CA - G3

  • Import it where? – Michael Hampton Dec 1 '15 at 12:58
  • I just want to add/import it to the server's trusted keystore. As far as I understand for RHEL7 would be the ca-bundle.crt file. I could be wrong though. – daelas Dec 1 '15 at 13:06
  • 1
    For what purpose? There is no global keystore on Linux operating systems. – Michael Hampton Dec 1 '15 at 13:37
  • In addition to Michael's comment, some of the default applications Red Hat ships do use a central location, as documented in RHEL solution 1549003, but many more do not and will need an application specific configuration... – HBruijn Dec 1 '15 at 14:54
  • Thanks for pointing it out, I though ca-bundle.crt was used as a global keystore. The certs are required by an httpd application (for external connections). – daelas Dec 1 '15 at 14:59

I appears by including the ca-cert bundle in /etc/pki/ca-trust/source/ and running update-ca-trust extract worked fine.

  • In my case I needed to install an intermediate (instead of a Root) cert, on release 7.6. After a look at a README file in /etc/pki/ca-trust, I opted for putting the cert retrieved from CA's website into /usr/share/pki/ca-trust-source/anchors/ and then run just update-ca-trust and it worked fine for me. Also quick tip to help verify results: trust list | grep label ; trust list | grep label | wc -l – Justin Mar 19 at 21:52

Copy the certificates to /etc/pki/ca-trust/source/anchors/ and after that execute update-ca-trust extract.

They should be available to all application that check that path for certificates (for example wget and curl).


3 steps works for me on this cases:

  1. certificate to /etc/pki/ca-trust/source/anchors/
  2. update-ca-trust force-enable
  3. update-ca-trust extract

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.