CA-LEGACY(8)

📦
version 2026.2.92_v9.0.319 · 4 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💖 CA-LEGACY(8) 💖

okay bestie, gather round, because this one is literally the glow-up guide to your system's legacy CA certs. the manual name is ca-legacy and yeah, the whole vibe is "manage the system configuration for legacy CA certificates." let's get into it 🎀

✨ SYNOPSIS ✨

ca-legacy [COMMAND]

🌸 DESCRIPTION 🌸

ca-legacy(8) is the girl whose whole job is either letting a set of legacy Certificate Authority (CA) certificates in or kicking them out of the system's list of trusted CA certificates. bouncer energy, honestly. 💅

so here's the tea: the list of CA certificates and trust flags that ship inside the ca-certificates package is based on the decisions made by Mozilla.org, according to the Mozilla CA policy. that's the source of truth, periodt.

but sometimes 😭 a removal or distrust decision from Mozilla.org can be incompatible with the requirements or limitations of some applications that also use the CA certificates list in the Linux environment. like, they're not trying to be messy, they just can't handle the change yet.

so the ca-certificates package might keep some CA certificates included and trusted by default — as long as the maintainers see it as necessary — even though Mozilla has removed them. these are what we call legacy CA certificates. 👑

and lowkey the general requirements to keep those legacy CA certificates included and trusted might change over time. for example, if functional limitations of software packages get resolved (slay for them), future versions of the ca-certificates package might reduce the set of legacy CA certificates that are included and trusted by default. so don't get too attached, fr fr.

that's exactly where ca-legacy(8) comes in: it can be used to override the default behaviour. main character move. 🌈

one thing to remember though — the mechanisms to individually trust or distrust CA certificates as described in update-ca-trust(8) still apply. those didn't go anywhere. 🦋

💅 COMMANDS 💅

  • check — shows you the current configuration. a lil vibe check, if you will. ✨
  • default — configures the system to use the default configuration, as recommended by the package maintainers. when in doubt, let the maintainers cook. 🍓
  • disable — configures the system to explicitly disable legacy CA certificates. with this configuration, the system will use the set of included and trusted CA certificates as released by Mozilla. strict mode, no exceptions. 🔥
  • install — reads the configuration file and sets the system configuration accordingly. this command runs automatically during upgrades of the ca-certificates package, so it's giving "I got this handled, don't worry about it." 👑

🎀 FILES 🎀

  • /etc/pki/ca-trust/ca-legacy.conf — a configuration file that the ca-legacy command will use and modify. the contents of the configuration file will be read on package upgrades. she's the little file with the whole personality, iykyk. 💜

🫶 AUTHOR 🫶

Written by Kai Engert. thank you for your service, legend. 😌

psst — <italic> heads up: if you mess with these configs, remember update-ca-trust(8) is still out there doing its own thing for individual trust decisions. ✨

that's the whole page, bestie 💖 go trust (or distrust) those legacy certs responsibly. bye babes!! 👋

ca-legacy — 10/22/2026 — CA-LEGACY(8) 🌸

📦 where this page comes from