OpenSSL:X509

lastmod 2024-05-21created 2019-01-208 edits

How to register a trusted root certificate

(Other) How to register a trusted root certificate

## Mac OS X Add:
$ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/new-root-certificate.crt
## Mac OS X Remove:
$ sudo security delete-certificate -c "<name of existing certificate>"

## Windows Add:
$ certutil -addstore -f "ROOT" new-root-certificate.crt
## Windows Remove:
$ certutil -delstore "ROOT" serial-number-hex

## Linux (Ubuntu, Debian) Add:
## 1. Copy your CA to dir /usr/local/share/ca-certificates/
## 2. Update the CA store:
$ sudo update-ca-certificates
## Linux (Ubuntu, Debian) Remove:
## 1. Remove your CA.
## 2. Update the CA store:
$ sudo update-ca-certificates –fresh
## Restart Kerio Connect to reload the certificates in the 32-bit versions or Debian 7.

## Linux (CentOs 6) Add:
## 1. Install the ca-certificates package:
$ yum install ca-certificates
## 2. Enable the dynamic CA configuration feature:
$ update-ca-trust force-enable
## 3. Add it as a new file to /etc/pki/ca-trust/source/anchors/:
$ cp foo.crt /etc/pki/ca-trust/source/anchors/
## 4. Use command:
$ update-ca-trust extract

Doing proper certification including the CA certificate

On Linux/Unix

sudo apt-get install ca-certificates

Add the certificate as a trusted root CA certificate. The directory locations are:

/etc/ssl/certs
/usr/local/share/ca-certificates/

Update the certificates:

sudo update-ca-certificates

If HTTPS (443) access to the domain is available

Download the certificate with openssl:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 > example.crt

## 만약 DER 포맷으로 필요할 경우:
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -outform DER > example.crt

Download the certificate with GNUTLS (gnutls-cli)

gnutls-cli --print-cert www.example.com < /dev/null > example.crt

Registering on macOS

WARNING
This is an answer from ChatGPT. Its accuracy needs to be verified.

Store in the system root certificate authority store:

To add a downloaded SSL/TLS certificate to the system root certificate authority store, run the security command in the terminal as follows.

sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" example.crt

Store in the personal user certificate store:

To add an SSL/TLS certificate to the personal user certificate store, run the security command in the terminal as follows.

sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" example.crt

Troubleshooting

certificate signed by unknown authority

(Linux) Fixing the x509: certificate signed by unknown authority error

Install the tools:

sudo apt-get install ca-certificates

Copy the certificates that are not in /etc/ssl/certs.