Usando Certificados de Sistema Compartilhados

NITISH SHARMA, Mirek Jahoda, Petr Bokoc Versão F31 and newer Last review: 2020

O armazenamento de Certificados do Sistema Compartilhado permite que o NSS, o GnuTLS, o OpenSSL e o Java compartilhem uma fonte padrão para recuperar âncoras de certificados do sistema e informações de lista negra. Por padrão, o repositório de confiança contém a lista de CA da Mozilla, incluindo confiança positiva e negativa. O sistema permite a atualização da lista principal de CA da Mozilla ou a escolha de outra lista de certificados.

Using the System-wide Trust Store

In Fedora, the consolidated system-wide trust store is located in the /etc/pki/ca-trust/ and /usr/share/pki/ca-trust-source/ directories. The trust settings in /usr/share/pki/ca-trust-source/ are processed with lower priority than settings in /etc/pki/ca-trust/.

Certificate files are treated depending on the subdirectory they are installed to the following directories:

  • for trust anchors

    • /usr/share/pki/ca-trust-source/anchors/ or

    • /etc/pki/ca-trust/source/anchors/

  • for distrusted certificates

    • /usr/share/pki/ca-trust-source/blocklist/ or

    • /etc/pki/ca-trust/source/blocklist/

  • for certificates in the extended BEGIN TRUSTED file format

    • /usr/share/pki/ca-trust-source/ or

    • /etc/pki/ca-trust/source/

In a hierarchical cryptographic system, a trust anchor is an authoritative entity which is assumed to be trustworthy. For example, in X.509 architecture, a root certificate is a trust anchor from which a chain of trust is derived. The trust anchor must be put in the possession of the trusting party beforehand to make path validation possible.

Adding New Certificates

Often, system administrators want to install a certificate into the trust store. This can be done with the trust anchor sub-command of the trust command, as described in Managing Trusted System Certificates.

Alternatively, you can simply copy the certificate file in the PEM or DER file format to the /etc/pki/ca-trust/source/anchors/ directory, followed by running the update-ca-trust command, for example:

# cp ~/certificate-trust-examples/Cert-trust-test-ca.pem /etc/pki/ca-trust/source/anchors/
# update-ca-trust

The update-ca-trust command ensures that the certificate bundles in application-specific formats, such as Java keystore, are regenerated.

The certificates installed in the above steps cannot be removed with the trust anchor --remove.

While the Firefox browser is able to use an added certificate without executing update-ca-trust, it is recommended to run update-ca-trust after a CA change. Also note that browsers, such as Firefox, Epiphany, or Chromium, cache files, and you might need to clear the browser’s cache or restart your browser to load the current system certificates configuration.

Managing Trusted System Certificates

To list, extract, add, remove, or change trust anchors, use the trust command. To see the built-in help for this command, enter it without any arguments or with the --help directive:

$ trust
usage: trust command <args>...

Common trust commands are:
  list             List trust or certificates
  extract          Extract certificates and trust
  extract-compat   Extract trust compatibility bundles
  anchor           Add, remove, change trust anchors
  dump             Dump trust objects in internal format

See 'trust <command> --help' for more information

To list all system trust anchors and certificates, use the trust list command:

$ trust list
pkcs11:id=%d2%87%b4%e3%df%37%27%93%55%f6%56%ea%81%e5%36%cc%8c%1e%3f%bd;type=cert
    type: certificate
    label: ACCVRAIZ1
    trust: anchor
    category: authority

pkcs11:id=%a6%b3%e1%2b%2b%49%b6%d7%73%a1%aa%94%f5%01%e7%73%65%4c%ac%50;type=cert
    type: certificate
    label: ACEDICOM Root
    trust: anchor
    category: authority
...
[output has been truncated]

To store a trust anchor into the system-wide trust store, use the trust anchor sub-command and specify a path.to a certificate, for example:

# trust anchor path.to/certificate.crt

To remove a certificate, use either a path.to a certificate or an ID of a certificate:

# trust anchor --remove path.to/certificate.crt
# trust anchor --remove "pkcs11:id=%AA%BB%CC%DD%EE;type=cert"
More information

All sub-commands of the trust commands offer a detailed built-in help, for example:

$ trust list --help
usage: trust list --filter=<what>

  --filter=<what>     filter of what to export
                        ca-anchors        certificate anchors
                        blacklist         blacklisted certificates
                        trust-policy      anchors and blacklist (default)
                        certificates      all certificates
                        pkcs11:object=xx  a PKCS#11 URI
  --purpose=<usage>   limit to certificates usable for the purpose
                        server-auth       for authenticating servers
                        client-auth       for authenticating clients
                        email             for email protection
                        code-signing      for authenticating signed code
                        1.2.3.4.5...      an arbitrary object id
  -v, --verbose       show verbose debug output
  -q, --quiet         suppress command output

Recursos Adicionais

Para obter mais informações, consulte as seguintes páginas do manual (man pages):

  • update-ca-trust(8)

  • trust(1)

Want to help? Learn how to contribute to Fedora Docs ›