Local CA cert isn't installed correctly on Ubuntu #24

wunter8 commented 2025年10月16日 06:52:12 +02:00

I have been trying to use Kitten. The cert has been showing up as an untrusted self-signed cert. I saw that it was put in the correct directory (/usr/local/share/ca-certificates/) for my OS (Ubuntu), but running sudo update-ca-certificates would just show

Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.

After some research, I found that the CA certificate needs to be in PEM format (which it is), but it also needs to have a .crt file extension (as described here: https://documentation.ubuntu.com/server/how-to/security/install-a-root-ca-certificate-in-the-trust-store/#:~:text=It%20is%20important%20that%20the%20certificate%20file%20has%20the%20.crt%20extension%2C%20otherwise%20it%20will%20not%20be%20processed.)

Once I renamed the auto-encrypt-localhost-CA-[id].pem file to auto-encrypt-localhost-CA-[id].crt, sudo update-ca-certificates grabbed the file and added it to the trust store.

mkcert puts the .crt extension on the file here: github.com/FiloSottile/mkcert@2a46726ceb/truststore_linux.go (L40)

The code will need to be updated somewhere around here:

I have been trying to use Kitten. The cert has been showing up as an untrusted self-signed cert. I saw that it was put in the correct directory (`/usr/local/share/ca-certificates/`) for my OS (Ubuntu), but running `sudo update-ca-certificates` would just show ``` Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. ``` After some research, I found that the CA certificate needs to be in PEM format (which it is), but it also needs to have a `.crt` file extension (as described here: https://documentation.ubuntu.com/server/how-to/security/install-a-root-ca-certificate-in-the-trust-store/#:~:text=It%20is%20important%20that%20the%20certificate%20file%20has%20the%20.crt%20extension%2C%20otherwise%20it%20will%20not%20be%20processed.) Once I renamed the `auto-encrypt-localhost-CA-[id].pem` file to `auto-encrypt-localhost-CA-[id].crt`, `sudo update-ca-certificates` grabbed the file and added it to the trust store. mkcert puts the `.crt` extension on the file here: https://github.com/FiloSottile/mkcert/blob/2a46726cebac0ff4e1f133d90b4e4c42f1edf44a/truststore_linux.go#L40 The code will need to be updated somewhere around here: https://codeberg.org/small-tech/auto-encrypt-localhost/src/commit/da1c4d5e8c1eae59b738fd4363ab5ec5fc979b2b/lib/CertificateAuthority.js#L89-L91