最後更新: 2017-06-01
目錄
Ubuntu
Centos 6
Folder
Centos 7
Ubuntu
update-ca-certificates
Centos 6
update-ca-trust - manage consolidated and dynamic configuration of CA certificates and associated trust
for new applications that read the consolidated configuration files found in the /etc/pki/ca-trust/extracted directory or
that load the PKCS#11 module p11-kit-trust.so
# Install
yum install ca-certificates
# 獲得: update-ca-trust
# /usr/share/pki/ca-trust-source/
# /etc/pki/ca-trust/source/
Usage
# To add a certificate in the simple PEM or DER file formats to the list of CAs trusted on the system:
1. add it as a new pem file to directory
cp my.pem /etc/pki/ca-trust/source/anchors
2.
update-ca-trust
3. 在 /etc/pki/ca-trust/extracted/ 建立 file
update-ca-trust extract
Files(Output File)
"update-ca-trust" 就是更新它們
/etc/pki/tls/certs/ca-bundle.crt # simple BEGIN/END CERTIFICATE file format
# COMODO RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907Y...
...
-----END CERTIFICATE-----
# ACCVRAIZ1
-----BEGIN CERTIFICATE-----
MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJ...
...
/etc/pki/tls/certs/ca-bundle.trust.crt # extended BEGIN/END TRUSTED CERTIFICATE file format
/etc/pki/ca-trust/extracted # Created using the "update-ca-trust extract"
ls /etc/pki/ca-trust/extracted
java openssl pem README
Folder
Simple trust anchors subdirectory:
/usr/share/pki/ca-trust-source/anchors/
/etc/pki/ca-trust/source/anchors/ # '/etc' override any other default configuration
Extended format directory:
/usr/share/pki/ca-trust-source/
/etc/pki/ca-trust/source/
/etc/pki/ca-trust/extracted/
Contains consolidated and automatically generated configuration files for consumption by applications,
which are created using the "update-ca-trust extract" command.
If your certificate is in the extended "BEGIN TRUSTED" file format
(which may contain distrust/blacklist trust flags, or trust flags for usages other than TLS) then:
add it as a new file to directory /etc/pki/ca-trust/source/anchors/
Centos 7 add trusted certificate
方法 1
yum install ca-certificates
update-ca-trust
方法 2
當"方法 1" 唔 work 時, 就要用以下方案
To add a certificate in the simple PEM or DER file formats to the list of CAs trusted on the system:
cp foo.crt /etc/pki/ca-trust/source/anchors/
OR
cp foo.ca-bundle.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust extract
Remark: 獲得 CA Cert. 的方法
Open a webpage that uses the CA with Firefox
Click the lock-icon in the addressbar -> show information -> show certificate
The certificate viewer will open
click details and choose the certificate of the certificate-chain, you want to import to CentOS
click "Export..." and save it as .crt file
