Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 3. Using shared system certificates

Learn to use the centralized system truststore in RHEL for managing TLS certificates. Using a shared trust location simplifies certificate management and verification across the system.

3.1. The system-wide truststore
Copier lien

RHEL contains a centralized system for managing TLS certificates. This shared certificate storage serves as a unified source that NSS, GnuTLS, OpenSSL, and Java use to retrieve system certificate anchors and blocklist information.

By default, the truststore contains the Mozilla CA list, which includes both positive and negative trust. You can update the core Mozilla CA list by using the centralized system.

The consolidated system-wide truststore is located in the /etc/pki/ca-trust/ and /usr/share/pki/ca-trust-source/ directories. The trust settings in /usr/share/pki/ca-trust-source/ have lower priority than settings in /etc/pki/ca-trust/.

The system treats certificate files based on the subdirectory to which you install them:

  • Trust anchors belong to

    • /usr/share/pki/ca-trust-source/anchors/ or
    • /etc/pki/ca-trust/source/anchors/.

  • Distrusted certificates are stored in

    • /usr/share/pki/ca-trust-source/blocklist/ or
    • /etc/pki/ca-trust/source/blocklist/.

  • Certificates in the extended BEGIN TRUSTED file (OpenSSL trust certificate) format are located in

    • /usr/share/pki/ca-trust-source/ or
    • /etc/pki/ca-trust/source/.

To add a new certificate to the truststore, copy the file containing your certificate to the corresponding directory and use the update-ca-trust command to apply the changes. Alternatively, use the trust anchor subcommand.

See the update-ca-trust(8) and trust(1) man pages on your system for more information.

Note

In a hierarchical cryptographic system, a trust anchor is an authoritative entity that other parties consider trustworthy. In the X.509 architecture, a root certificate is a trust anchor from which a chain of trust is derived. To enable chain validation, the trusting party must first have access to the trust anchor.

3.2. Adding new certificates to the system-wide truststore
Copier lien

You can add new certificates to the system-wide truststore so that all cryptographic applications running on the system recognize them as trusted.

To acknowledge applications on your system with a new source of trust, add the corresponding certificate to the system-wide store and use the update-ca-trust command.

Note

Even though the Mozilla Firefox browser can use an added certificate without a prior execution of update-ca-trust, enter the update-ca-trust command after every CA change. Also note that browsers, such as Mozilla Firefox and Chromium, cache files, and you might have to clear your browser’s cache or restart your browser to load the current system certificate configuration.

Prerequisites

  • The ca-certificates package is present on the system.

Procedure

  1. Add a certificate in the simple PEM or DER file formats to the list of CAs trusted on the system, copy the certificate file to the /usr/share/pki/ca-trust-source/anchors/ or /etc/pki/ca-trust/source/anchors/ directory, for example: 

    # cp <~/certificate-trust-examples/Cert-trust-test-ca.pem> /usr/share/pki/ca-trust-source/anchors/
    Copy to Clipboard Toggle word wrap

  2. Update the system-wide truststore configuration, use the update-ca-trust command: 

    # update-ca-trust extract
    Copy to Clipboard Toggle word wrap

You can manage certificates within the shared system-wide truststore by using the trust command.

You can add or remove certificates from the system-wide truststore by using either basic file operations with the corresponding files and by using the update-ca-trust command as described in the Adding new certificates to the system-wide truststore section or the trust command.

The trust command provides a way for managing certificates in the shared system-wide truststore. You can use its subcommands to list, extract, add, remove, or change trust anchors.

  • To see the built-in help for the trust command, enter it without any arguments or with the --help directive. Also, all subcommands of the trust commands provide a detailed built-in help, for example: 

    $ trust list --help
usage: trust list --filter=<what>
…
    Copy to Clipboard Toggle word wrap

  • To list all system trust anchors and certificates, use the trust list command, for example: 

    $ trust list
…
pkcs11:id=%DD%04%09%07%A2%F5%7A%7D%52%53%12%92%95%EE%38%80%25%0D%A6%59;type=cert
    type: certificate
    label: SSL.com Root Certification Authority RSA
    trust: anchor
    category: authority
…
    Copy to Clipboard Toggle word wrap

  • To store a trust anchor into the system-wide truststore, use the trust anchor subcommand and specify a path to a certificate. Replace <path.to/certificate.crt> by a path to your certificate and its file name: 

    # trust anchor <path.to/certificate.crt>
    Copy to Clipboard Toggle word wrap

  • To remove a certificate, use either a path to a certificate or the ID of a certificate: 

    # trust anchor --remove <path.to/certificate.crt>
# trust anchor --remove "pkcs11:id=<%AA%BB%CC%DD%EE>;type=cert"
    Copy to Clipboard Toggle word wrap

See the trust(1) man page on your system for more information.

Retour au début
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2025 Red Hat