0

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the future. I have tried to automate adding and removing self-signed ca .pem files and noticed, that sometimes the .pem files reside in /etc/ssl/certs (debian), sometimes it reside in /usr/share/pki/trust or /etc/pki/trust (opensuse) and sometimes those dirs are empty or not existing.

Is there a common way or a command to add/remove ca-certificates on linux to the "official" openssl stack on a machine? If not, how can I find out the right place for ca-certificates or where (in which config-file) is the folder defined for openssl?

I know that this is only half of the route because some applications are using their own private ca-stack (curl?) but it helps a lot to have the self-signed ca-cert in a well known place.

1
1

Is there a common way or a command to add/remove ca-certificates on linux to the "official" openssl stack on a machine?

I can't find a proper duplicate but this has been answered before and the answer is:

No, distro's use different locations for openssl and after adding a CA certificate to openssl's CA collection, you still have to provide for applications that don't use openssl as a crypto library, but which use for instance Mozilla's NSS or GNU TLS, or Java applications that use a vault format.

1
  • This is not the Answer I hoped for but it seems indeed that one of the pillows of internet security is secured by obscurity. The problem with NSS, GNU TLS and Java could be solved by calling the update-ca-certificate tool on many distributions but even this tool has not a standard behavior on different Distributions. Now it make sense to that firefox et al. uses their own set of ca-certificates. – user762353 May 6 '16 at 10:36
0

From http://gagravarr.org/writing/openssl-certs/others.shtml#ca-openssl

Another way to check On most OpenSSL builds, if you run the command openssl version -d it will report the directory used, eg OPENSSLDIR: "/usr/lib/ssl" (directory is /usr/lib/ssl). On some systems (eg Ubuntu), the path given from this will contain a symlink to the real certificates store elsewhere on the system, so you might want to double-check!

1
  • No, this command will return the basefolder used by openssl; On opensuse e.g. it will return /etc/ssl, the certificates used by openssl are in /etc/ssl/certs which is linked to /var/lib/ca-certificates/pem. And those folder is filled by update-ca-certificate.But the source ca-certificate used by update-ca-certificate (and some clients like google-chrome) is /usr/share/pki/trust – user762353 May 4 '16 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.