make-ca-0.7

Installation of make-ca

The make-ca script will download and process the certificates included in the certdata.txt file for use in multiple certificate stores (if the associated applications are present on the system). Additionally, any local certificates stored in /etc/ssl/local will be imported to the certificate stores. Certificates in this directory should be stored as PEM encoded OpenSSL trusted certificates.

To create an OpenSSL trusted certificate from a regular PEM encoded file, you need to add trust arguments to the openssl command, and create a new certificate. There are three trust types that are recognized by the make-ca script, SSL/TLS, S/Mime, and code signing. For example, using the CAcert roots, if you want to trust both for all three roles, the following commands will create appropriate OpenSSL trusted certificates (run as the root user):

install -vdm755 /etc/ssl/local &&
wget http://www.cacert.org/certs/root.crt &&
wget http://www.cacert.org/certs/class3.crt &&
openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
        > /etc/ssl/local/CAcert_Class_1_root.pem &&
openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
        > /etc/ssl/local/CAcert_Class_3_root.pem

If one of the three trust arguments is omitted, the certificate is neither trusted, nor rejected for that role. Clients that use OpenSSL or NSS encountering this certificate will present a warning to the user. Clients using GnuTLS without p11-kit support are not aware of trusted certificates. To include this CA into the ca-bundle.crt (used for GnuTLS), it must have serverAuth trust. Additionally, to explicitly disallow a certificate for a particular use, replace the -addtrust flag with the -addreject flag.

To install the various certificate stores, first install the make-ca script into the correct location. As the root user:

make install

As the root user, download and update the certificate stores with the following command:

sed -e 's%= /etc/ssl;%= "/etc/ssl";%' \
    -e 's%= /usr;%= "/usr";%'         \
    -i /usr/bin/c_rehash              &&
/usr/sbin/make-ca -g

The sed command works around missing quotes in c_rehash from openssl-1.1.0h and can be safely rerun (the " inserted the first time will prevent matches on subsequent runs).

You should periodically update the store with the above command either manually, or via a cron job.

The default certdata.txt file provided by make-ca is obtained from the mozilla-release branch, and is modified to provide a Mercurial revision. This will be the correct version for most systems. There are, however, several other variants of the file available for use that might be preferred for one reason or another, including the files shipped with Mozilla products in this book. RedHat and OpenSUSE, for instance, use the version included in NSS-3.36.1. Additional upstream downloads are available at the links below.