Answer by Rosta Kosta for Is it possible to install a custom CA certificate without the ca-certificates package on Debian?

• Copy my_own_ca.crt to /usr/local/share/ca-certificates
• run script update-ca-certificates

update-ca-certificates create necessary simlink and update /etc/ssl/certs/ca-certificates.crt file. Linux utilities tools like wget or curl use this file as CA file as default.

Or find the switch that specifies the CA file or switch for disable check certificate. For wget it is:

• wget --no-check-certificate - for disable CA check
• wget --ca-certificate=file - Use file as the file with the bundle of certificate authorities ("CA") to verify the peers. The certificates must be in PEM format.

Example

Copy your own ca with crt suffix to /usr/local/share/ca-certificates

/usr/local/share/ca-certificates# ls -alFhcelkem 16Kdrwxrwsr-x 2 root staff 4,0K úno  5 13:02 ./drwxrwsr-x 7 root staff 4,0K kvě  7  2014 ../-rw-r--r-- 1 root staff 1,5K úno  5 13:02 thawte-Primary-Root-CA-G3.crt-rw-r--r-- 1 root staff 1,7K úno  5 13:01 thawte-SHA256-ssl-ca.crt

Run update-ca-certificates

/usr/local/share/ca-certificates# update-ca-certificates Updating certificates in /etc/ssl/certs... WARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pemWARNING: Skipping duplicate certificate thawte-Primary-Root-CA-G3.pemWARNING: Skipping duplicate certificate thawte-primary-root.pemWARNING: Skipping duplicate certificate thawte-primary-root.pem2 added, 0 removed; done.Running hooks in /etc/ca-certificates/update.d....done.

Verify:

/etc/ssl/certs# ls -alFh | grep locallrwxrwxrwx 1 root root   62 úno  5 13:03 thawte-Primary-Root-CA-G3.pem -> /usr/local/share/ca-certificates/thawte-Primary-Root-CA-G3.crtlrwxrwxrwx 1 root root   57 úno  5 13:03 thawte-SHA256-ssl-ca.pem -> /usr/local/share/ca-certificates/thawte-SHA256-ssl-ca.crt

/etc/ssl/certs# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -nooutsubject=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ESissuer=/CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ESsubject=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.issuer=/C=CO/O=Sociedad Cameral de Certificaci\xC3\xB3n Digital - Certic\xC3\xA1mara S.A./CN=AC Ra\xC3\xADz Certic\xC3\xA1mara S.A.subject=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CAissuer=/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CAsubject=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Rootissuer=/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root...Find your CA