Trusting additional CAs in Fedora / RHEL / CentOS: an alternative to editing /etc/pki/tls/certs/ca-bundle.crt (or /etc/pki/tls/cert.pem)

Around the internet, you can find various pages advising appending CA certificates to /etc/pki/tls/certs/ca-bundle.crt or /etc/pki/tls/cert.pem (they’re the same file, one’s a symlink to the other) as a good way to trust them.

This may be necessary, but it has drawbacks (the main one being that once you’ve edited the file, it will no longer be automatically updated; updates will appear as ca-bundle.crt.rpmnew and you’ll have to remember to manually move it to ca-bundle.crt and re-append your custom certs). There’s an alternative approach that may be better for you, even on really old RHEL / CentOS.

On Fedora since 19, RHEL / CentOS 7, and RHEL / CentOS 6 since this update, the Shared System Certificates feature is available. With that system, the correct method is to place the certificate to be trusted (in PEM format) in /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust. (If the certificate is in OpenSSL’s extended BEGIN TRUSTED CERTIFICATE format, place it in /etc/pki/ca-trust/source). On RHEL 6, you have to activate the system with update-ca-trust enable after installing the update; if you don’t want to use it, you can try the approach below.

On RHEL / CentOS 5, that system isn’t available. But it’s still not a good idea to modify the distribution’s bundle file unless you really have to, as explained above.

Instead of appending to the bundle file, you can try placing the certificate to be trusted (in PEM format with the extension .pem) in /etc/pki/tls/certs and run sudo c_rehash (you may need a yum install /usr/bin/c_rehash). The .pem extension is important, c_rehash will only process files with this extension.

Readers of my last post may grok what’s going on there: /etc/pki/tls/certs is OpenSSL’s ‘default CApath’ on RHEL/CentOS, and OpenSSL will trust both certificates found in the ‘default CAfile’ – /etc/pki/tls/cert.pemand in the ‘default CApath’ – /etc/pki/tls/certs.

The caveat is that this only works for things that use OpenSSL and use its default trust store locations. It won’t work for apps that use OpenSSL but directly use the bundle file instead of using OpenSSL’s ‘default trust store’ function, and it won’t work for anything based on GnuTLS (whereas editing the bundle file often will, as we often have those patched to load the bundle file directly).

So sometimes you just have to edit the bundle file – but in some cases you might be able to avoid it.

8 Responses

  1. Umesh Sundareshan
    Umesh Sundareshan March 22, 2016 at 11:57 am | | Reply

    Hi,

    How do we remove a CA from the ca-bundle.crt or cert.pem? By removing the certificate manually using an editor would work?

    Thanks,
    Umesh

  2. Maciej
    Maciej May 9, 2016 at 6:55 am | | Reply

    Yes, editor will do the work.

    Maicej,
    http://www.niejesteminformatykiem.pl

  3. Mauricio
    Mauricio May 13, 2016 at 2:00 pm | | Reply

    Thank you very much for this!

  4. CyberDummy
    CyberDummy August 5, 2016 at 1:28 pm | | Reply

    So…

    Should the certificates that were placed in /etc/pki/ca-trust/source/anchors/ be removed after this operation is completed? I am thinking that they should.

  5. Andreas Schöneck
    Andreas Schöneck August 11, 2016 at 11:26 pm | | Reply

    Nowadays, the place to put the pem files is /usr/share/pki/ca-trust-source/anchors

    For more information, read /usr/share/pki/ca-trust-source/README

    1. John Peter Harvest
      John Peter Harvest September 22, 2016 at 4:41 am | | Reply

      Both directories can be used!

      From the update-ca-trust man page:

      Files in subdirectories below the directory hierarchy /usr/share/pki/ca-trust-source/ contain CA certificates and trust settings in the PEM file format. The trust settings found here will be interpreted with a low priority.
      Files in subdirectories below the directory hierarchy /etc/pki/ca-trust/source/ contain CA certificates and trust settings in the PEM file format. The trust settings found here will be interpreted with a high priority.

  6. Binh Thanh Nguyen
    Binh Thanh Nguyen February 22, 2017 at 1:57 am | | Reply

    Thanks, nice tips

Leave a Reply to Mauricio Cancel reply

Your email address will not be published. Required fields are marked *