UPDATE-CA-CERTIFICATES(8)

🎀 UPDATE-CA-CERTIFICATES(8) 🎀

okay so this is the system manager's manual page for update-ca-certificates 💅 bestie, let's get into it 🫶

✨ NAME ✨

update-ca-certificates is the thing that updates /etc/ssl/certs and ca-certificates.crt 🔐

🧚 SYNOPSIS 🧚

update-ca-certificates [options]

💖 DESCRIPTION 💖

This manual page documents briefly the update-ca-certificates command. Quick and easy 🌸

update-ca-certificates is a program that manages the collection of TLS certificates for the local machine and generates ca-certificates.crt 🔐 ca-certificates.crt is a single-file of concatenated certificates. The collection of individual certificates is stored at /etc/ssl/certs. It's giving organized ✨

The program reads the configuration file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that should be trusted. Lines that begin with "#" are comment lines and thus ignored, so you can leave yourself little notes 🙈 Lines that begin with "!" are deselected, which deactivates the CA certificate in question. Bye bye, cert 💀

Certificates must be in PEM format and have a .crt extension in order to be included by update-ca-certificates. Furthermore, all certificates with a .crt extension found below /usr/local/share/ca-certificates are also included and implicitly trusted. Main character energy 👑

To add one or more certificates to the machine, copy the certificates in PEM format with the *.crt extension to /usr/local/share/ca-certificates. There should be one certificate per file, and not multiple certificates in a single file. Then run update-ca-certificates to merge the new certificates into the existing machine store at /etc/ssl/certs. Periodt 💅

Before terminating, update-ca-certificates invokes run-parts on /etc/ca-certificates/update.d and calls each hook with a list of certificates: those added are prefixed with a +, those removed are prefixed with a -. So you always know what changed 👀✨

🌈 OPTIONS 🌈

A summary of options is included below. Here's the tea 🍓

• -h, --help — Show summary of options. Your go-to when you forget everything 🫠
• -v, --verbose — Be verbose. Output openssl rehash. Chatty mode, activated 🗣️
• -f, --fresh — Fresh updates. Remove symlinks in /etc/ssl/certs directory. Clean slate, bestie 🧼
• --certsconf — Change the configuration file. By default, the file /etc/ca-certificates.conf is used. Swap in your own config if you're feeling extra 💅
• --certsdir — Change the certificate directory. By default, the directory /usr/share/ca-certificates is used. 📂
• --localcertsdir — Change the local certificate directory. By default, the directory /usr/local/share/ca-certificates is used. Your own certs, your own rules 🦋
• --etccertsdir — Change the /etc certificate directory. By default, the directory /etc/ssl/certs is used. 🌸

📁 FILES 📁

• /etc/ca-certificates.conf — A configuration file. The boss of the whole operation 👑
• /etc/ssl/certs/ca-certificates.crt — A single-file version of CA certificates. This holds all CA certificates that were activated in /etc/ca-certificates.conf. The big bundle 🎀
• /usr/share/ca-certificates — Directory of CA certificates provided by the distribution. Distro-approved vibes ✨
• /usr/local/share/ca-certificates — Directory of local CA certificates, with .crt extension, provided by the user. Your personal collection 💜

🦋 SEE ALSO 🦋

• openssl(1) — go check it out, it's iconic 🔥

🫶 AUTHOR 🫶

This manual page was written by Fumitoshi UKAI <ukai@debian.or.jp>, for the Debian project (but may be used by others). Huge shoutout to them 💖

---

Byeee, bestie! 🌈 This page is from the System Manager's Manual, manual name UPDATE-CA-CERTIFICATES(8), dated 20 April 2003. Stay secure and keep your certs fresh 💅✨🧚