31

How can I import a self-signed certificate in Red-Hat Linux.

I'm not an expert with respect to certificates and find it difficult to find the right answer through googling, since I don't know the difference between a .cer, .crt or a .pem. Having said that, what I would like to do should not be rocket science (In windows I can do this with a few clicks in my browser) I want to connect to a server that makes use of a self-signed certificate. For example using wget, without having to use the --no-check-certificate option. To make this work I will have to add the self-signed certificate of the server to my RedHat box. I have found out the certificates reside in /etc/pki/tls. But I am at a loss what actions I should perform to make wget function without complaining.

I can get the SSL certificate from the server using:

openssl s_client -connect server:443

The certificate is between "BEGIN CERTIFICATE and END CERTIFICATE" I do not know what kind of certificate this is. Next I will have to put it in the /etc/pki/tls/certs directory and apply some openssl secert sauce I don't know about. Can you help?

4 Answers 4

47

I don't know of a way to import a specific site-cert into OpenSSL's trust db (I wish I did!), but since you're talking about a self-signed cert we can approach it by importing your cert as new trusted CA cert. Warning though: you're also going to be trusting any sites that are signed by that cert.

Find and download the cert

You can download a self-signed cert directly from a site quickly with:

openssl s_client -connect server:443 <<<'' | openssl x509 -out /path/file

Note that you should only do this in the case of a self-signed cert (as mentioned in the original question). If the cert is signed by some other CA, you can't run with the above; instead, you will need to find the appropriate CA cert and download that.

Import the cert and make it trusted

The update-ca-trust command was added in Fedora 19 and RHEL6 via RHEA-2013-1596. If you have it, your steps are dumb-simple (but require root/sudo):

  1. copy the CA cert to /etc/pki/ca-trust/source/anchors/
  2. update-ca-trust enable; update-ca-trust extract
  3. (Note that the enable command isn't necessary in RHEL7 & modern Fedora)

If you don't have update-ca-trust, it's only a little harder (and still requires root/sudo):

  1. cd /etc/pki/tls/certs
  2. copy the CA cert here
  3. ln -sv YOURCERT $(openssl x509 -in YOURCERT -noout -hash).0

PS: The question mentioned Red Hat, but for anyone looking at doing the same with something besides Fedora/RHEL, wiki.cacert.org/FAQ/ImportRootCert might be helpful.

6
  • // , This was the only thing that worked on my supposedly modern CEntOS 7.5 freshly built system. update-ca-trust is unreliable. Commented Jul 8, 2019 at 23:22
  • Do you have a command to validate the success of the above commands? Commented Jan 16, 2020 at 12:32
  • This works in Oracle Enterprise Linux 6, too. I'm quite certain that the enable argument is required on this platform, for what it's worth. Commented Apr 24, 2020 at 13:08
  • This works in Oracle Enterprise Linux 7, too and I don't put the enable argument.
    – Duy Tran
    Commented May 18, 2021 at 4:59
  • Worked on RHEL9.3 (i had trouble because it didn't worked the way i used to do it with Debian)
    – Corentin
    Commented Feb 22 at 13:43
9

You can do what you want to do using these steps:

  1. Put the SSL certificate (including the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines) into a file in the directory "/etc/pki/tls/certs" - for the sake of example, let's call it "myserver.pem".
  2. Compute the certificate hash of this certificate by running

    openssl x509 -noout -hash -in /etc/pki/tls/certs/myserver.pem

    for the sake of example, let's assume the hash value is "1a2b3c4d".

  3. Make a symbolic link in the certs directory based on this hash value, like this:

    ln -s /etc/pki/tls/certs/myserver.pem /etc/pki/tls/certs/1a2b3c4d.0

    I'm assuming that there are no other certificates already in this directory that hash to the same hash value - if there already is a "1a2b3c4d.0", then make your link "1a2b3c4d.1" instead (or if there's already a ".1", make yours ".2", etc...)

wget and other tools that use SSL will then recognize that certificate as valid. There may be a simpler way to do this using a GUI but works to do it via the command line.

1
  • 5
    One thing that tripped me up with this answer (and led to me researching and eventually writing my own answer) was the lack of mention about how you can only put CA certs in /etc/pki/tls/certs/, i.e.: you cannot just import & trust some non-self-signed site cert here.
    – rsaw
    Commented Jun 29, 2015 at 20:18
0

This question lacks accepted answer which should be the one with most likes.

And as this is still needed sometimes, here is the solution I used on ubi-min RedHat base image to customize my docker image.

Just to clarify, setup includes corporate Nexus proxy for RH yum repos, and proxy sert is self-signed, and also container will connect to some hosts having self-signed certs.

As container is rootless, I have to switch first:

USER root
ADD <your-cert.crt> /etc/pki/ca-trust/source/anchors/<your-cert.crt>
RUN update-ca-trust enable; update-ca-trust extract
RUN sed -i 's#https://cdn-ubi.redhat.com/content/public/ubi#https://proxy-with-your-cert/cdn-ubi-redhat#g' /etc/yum.repos.d/ubi.repo
RUN microdnf install nano
USER nobody
0

in my case (RHEL8) helped next steps:

  1. Convert mycert.cet to mycert.pem by command

    openssl x509 -inform der -in "mycert.cer" -out "mycert.pem"

  2. Move .pem file to directory /etc/pki/ca-trust/source/anchors

    sudo mv "mycert.pem" /etc/pki/ca-trust/source/anchors

  3. last command

    sudo update-ca-trust

1
  • This seems like a simple and straightforward answer
    – NKP
    Commented Jun 24 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.