Trusting additional CAs in Fedora / RHEL / CentOS: an alternative to editing /etc/pki/tls/certs/ca-bundle.crt (or /etc/pki/tls/cert.pem)

Around the internet, you can find various pages advising appending CA certificates to /etc/pki/tls/certs/ca-bundle.crt or /etc/pki/tls/cert.pem (they’re the same file, one’s a symlink to the other) as a good way to trust them.

This may be necessary, but it has drawbacks (the main one being that once you’ve edited the file, it will no longer be automatically updated; updates will appear as ca-bundle.crt.rpmnew and you’ll have to remember to manually move it to ca-bundle.crt and re-append your custom certs). There’s an alternative approach that may be better for you, even on really old RHEL / CentOS.

On Fedora since 19, RHEL / CentOS 7, and RHEL / CentOS 6 since this update, the Shared System Certificates feature is available. With that system, the correct method is to place the certificate to be trusted (in PEM format) in /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust. (If the certificate is in OpenSSL’s extended BEGIN TRUSTED CERTIFICATE format, place it in /etc/pki/ca-trust/source). On RHEL 6, you have to activate the system with update-ca-trust enable after installing the update; if you don’t want to use it, you can try the approach below.

On RHEL / CentOS 5, that system isn’t available. But it’s still not a good idea to modify the distribution’s bundle file unless you really have to, as explained above.

Instead of appending to the bundle file, you can try placing the certificate to be trusted (in PEM format with the extension .pem) in /etc/pki/tls/certs and run sudo c_rehash (you may need a yum install /usr/bin/c_rehash). The .pem extension is important, c_rehash will only process files with this extension.

Readers of my last post may grok what’s going on there: /etc/pki/tls/certs is OpenSSL’s ‘default CApath’ on RHEL/CentOS, and OpenSSL will trust both certificates found in the ‘default CAfile’ – /etc/pki/tls/cert.pemand in the ‘default CApath’ – /etc/pki/tls/certs.

The caveat is that this only works for things that use OpenSSL and use its default trust store locations. It won’t work for apps that use OpenSSL but directly use the bundle file instead of using OpenSSL’s ‘default trust store’ function, and it won’t work for anything based on GnuTLS (whereas editing the bundle file often will, as we often have those patched to load the bundle file directly).

So sometimes you just have to edit the bundle file – but in some cases you might be able to avoid it.

13 Responses

  1. Umesh Sundareshan
    Umesh Sundareshan March 22, 2016 at 11:57 am | | Reply


    How do we remove a CA from the ca-bundle.crt or cert.pem? By removing the certificate manually using an editor would work?


  2. Maciej
    Maciej May 9, 2016 at 6:55 am | | Reply

    Yes, editor will do the work.


  3. Mauricio
    Mauricio May 13, 2016 at 2:00 pm | | Reply

    Thank you very much for this!

  4. CyberDummy
    CyberDummy August 5, 2016 at 1:28 pm | | Reply


    Should the certificates that were placed in /etc/pki/ca-trust/source/anchors/ be removed after this operation is completed? I am thinking that they should.

  5. Andreas Schöneck
    Andreas Schöneck August 11, 2016 at 11:26 pm | | Reply

    Nowadays, the place to put the pem files is /usr/share/pki/ca-trust-source/anchors

    For more information, read /usr/share/pki/ca-trust-source/README

    1. John Peter Harvest
      John Peter Harvest September 22, 2016 at 4:41 am | | Reply

      Both directories can be used!

      From the update-ca-trust man page:

      Files in subdirectories below the directory hierarchy /usr/share/pki/ca-trust-source/ contain CA certificates and trust settings in the PEM file format. The trust settings found here will be interpreted with a low priority.
      Files in subdirectories below the directory hierarchy /etc/pki/ca-trust/source/ contain CA certificates and trust settings in the PEM file format. The trust settings found here will be interpreted with a high priority.

  6. Binh Thanh Nguyen
    Binh Thanh Nguyen February 22, 2017 at 1:57 am | | Reply

    Thanks, nice tips

  7. Matthew
    Matthew August 23, 2018 at 8:07 am | | Reply

    Thank you for this article and the comments/tips below – cleared things up for me! I was wondering why there was more than one directory to use?!

  8. in
    in September 26, 2018 at 8:20 am | | Reply

    I always get the error Failed to install certificate: A valid full certificate chain from the host certificate to the Certificate Authority’s certificate must be provided.
    Help please

  9. Paul Collins
    Paul Collins December 10, 2018 at 2:37 pm | | Reply

    @in, if asked for a full certificate chain, and pem (text) format files are allowed (as it appears to be in this context), you may be able to concatenate the needed certificates together (specific domain, intermediate, and root) into a single file and use that.

    General chain file creation for several scenarios:

    Mainly I’m here to add my thanks for the useful instructions.

  10. alla
    alla June 18, 2019 at 2:32 am | | Reply

    hmm I have a problem, can you pls help me?

    I have .crt cert-file from Windows, I export it in base64 format, and it looks like that:

    some more strings

    So i put this crt file in /etc/pki/ca-trust/source/anchors/cert.crt
    and execute “update-ca-trust extract”. No error codes, nothing in /var/log/messages.
    So if I check ls -al /etc/pki/tls/certs/ca-bundle.crt I see what nothing changes – last change date of file is 2 months ago.
    Why this didn’t work?

    1. Gregory Young
      Gregory Young June 28, 2019 at 8:36 am | | Reply

      Check /etc/pki/tls/certs/, it should be at the top. The question I have is why it gets put in this file, when the /etc/pki/tls/certs/ca-bundle.crt file is referenced by openssl and others?

Leave a Reply

Your email address will not be published. Required fields are marked *