Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 3. Using shared system certificates

The shared system certificate storage enables NSS, GnuTLS, OpenSSL, and Java to share a default source for retrieving system certificate anchors and blocklist information.

3.1. The system-wide truststore
Copy link

Red Hat Enterprise Linux provides a centralized system for managing TLS certificates. By default, the truststore contains the Mozilla CA list, which includes both positive and negative trust. The system enables you to update the core Mozilla CA list.

The consolidated system-wide truststore is located in the /etc/pki/ca-trust/ and /usr/share/pki/ca-trust-source/ directories. The trust settings in /usr/share/pki/ca-trust-source/ have lower priority than settings in /etc/pki/ca-trust/.

The system treats certificate files based on the subdirectory to which you install them:

  • Trust anchors belong to

    • /usr/share/pki/ca-trust-source/anchors/ or
    • /etc/pki/ca-trust/source/anchors/.

  • Distrusted certificates are stored in

    • /usr/share/pki/ca-trust-source/blocklist/ or
    • /etc/pki/ca-trust/source/blocklist/.

  • Certificates in the extended BEGIN TRUSTED file (OpenSSL trust certificate) format are located in

    • /usr/share/pki/ca-trust-source/ or
    • /etc/pki/ca-trust/source/.

To add a new certificate to the truststore, you can copy the file containing your certificate to the corresponding directory and use the update-ca-trust command to apply the changes. Alternatively, you can use the trust anchor sub-command.

Note

In a hierarchical cryptographic system, a trust anchor is an authoritative entity that other parties consider trustworthy. In the X.509 architecture, a root certificate is a trust anchor from which a chain of trust is derived. To enable chain validation, the trusting party must first have access to the trust anchor.

To acknowledge applications on your system with a new source of trust, add the corresponding certificate to the system-wide store and use the update-ca-trust command.

Prerequisites

  • The ca-certificates package is present on the system.

Procedure

  1. Add a certificate in the simple PEM or DER file formats to the list of CAs trusted on the system, copy the certificate file to the /usr/share/pki/ca-trust-source/anchors/ or /etc/pki/ca-trust/source/anchors/ directory, for example: 

    # cp <~/certificate-trust-examples/Cert-trust-test-ca.pem> /usr/share/pki/ca-trust-source/anchors/
    Copy to Clipboard Toggle word wrap

  2. Update the system-wide truststore configuration, use the update-ca-trust command: 

    # update-ca-trust extract
    Copy to Clipboard Toggle word wrap
Note

Even though the Firefox browser can use an added certificate without a prior execution of update-ca-trust, enter the update-ca-trust command after every CA change. Also note that browsers, such as Firefox and Chromium, cache files, and you might have to clear your browser’s cache or restart your browser to load the current system certificate configuration.

You can add or remove certificates from system-wide truststore by using either basic file operations with the corresponding files and by using the update-ca-trust command as described in the Adding new certificates to the system-wide truststore section or the trust command.

The trust command provides a way for managing certificates in the shared system-wide truststore. You can use its sub-commands to list, extract, add, remove, or change trust anchors.

  • To see the built-in help for the trust command, enter it without any arguments or with the --help directive. Also, all sub-commands of the trust commands provide a detailed built-in help, for example: 

    $ trust list --help
usage: trust list --filter=<what>
…
    Copy to Clipboard Toggle word wrap

  • To list all system trust anchors and certificates, use the trust list command, for example: 

    $ trust list
…
pkcs11:id=%DD%04%09%07%A2%F5%7A%7D%52%53%12%92%95%EE%38%80%25%0D%A6%59;type=cert
    type: certificate
    label: SSL.com Root Certification Authority RSA
    trust: anchor
    category: authority
…
    Copy to Clipboard Toggle word wrap

  • To store a trust anchor into the system-wide truststore, use the trust anchor sub-command and specify a path to a certificate. Replace <path.to/certificate.crt> by a path to your certificate and its file name: 

    # trust anchor <path.to/certificate.crt>
    Copy to Clipboard Toggle word wrap

  • To remove a certificate, use either a path to a certificate or the ID of a certificate: 

    # trust anchor --remove <path.to/certificate.crt>
# trust anchor --remove "pkcs11:id=<%AA%BB%CC%DD%EE>;type=cert"
    Copy to Clipboard Toggle word wrap
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat