Skip to main content

Install Certificate Authority certificates

These instruction assume the user has administrative access to the server/workstation.

For the Ansible Automation Platform, follow the instructions for RHEL distributions. This will ensure the private CA is passed to execution environments.

Windows

First copy the CA certificate(s) to the Windows server/workstation.

The following files were copied to the asm_service home directory.

  • Arkansas_State_University_Root_CA_certificate.cer
  • Arkansas_State_University_Issuing_CA_certificate.cer

Windows GUI

  • Double click on the CA certificate to start the install process.
  • Select Install Certificate...

image.png

  • Select Local Machine for the store location and click Next.

image.png

 

  • On the Certificate Store dialog
    • Select Place all certificates in the following store
    • Select Browse
    • For the Arkansas_State_University_Root_CA_certificate.cer certificate
      • Choose the Trusted Root Certification Authorities
    • For the Arkansas_State_University_Issuing_CA_certificate.cer certificate
      • Choose the Intermediate Certificatoin Authorities
    • Click Next

    • image.png

      • Select Finish

      • image.png

  • Select Ok

    image.png

Windows prompt

From an administrative command prompt or PowerShell session, extecute the following two commands.

# Install the Root CA certificate
certutil -addstore -f root "C:\Users\asm_service\Arkansas_State_University_Root_CA_certificate.cer"

# Install the Intermediate (Issuing) CA certificate
certutil -addstore -f intermediate "C:\Users\asm_service\Arkansas_State_University_Issuing_CA_certificate.cer"

Linux

First copy the CA certificate(s) to the linux server/workstation and change the extension from .cer to .crt.

RHEL distributions

  • Make sure that the ca-certificates package is installed

    sudo dnf install ca-certificates

  • Copy the CA certificate(s) to /etc/pki/ca-trust/source/anchors/

    sudo cp CA_CERT /etc/pki/ca-trust/source/anchors/CA_CERT.crt

    Repeat for each certificate that needs to be added to the trust store.

  • Update the system certificate trust store

    sudo update-ca-trust extract

    Tip

    extract is not strictly needed but it does provide more warnings if there is any issues.

  • Verify the certificates were added to the trust store

    trust list | grep "My Private CA Name"

RHEL example

This example uses the Arkansas State University private certificate authority.

The following files were copied to the asm_service home directory.

  • Arkansas_State_University_Root_CA_certificate.cer
  • Arkansas_State_University_Issuing_CA_certificate.cer

# Copy the certificates to the correctly directory
# Note the extension change from .cer to .crt
$ sudo cp /home/asm_service/Arkansas_State_University_Root_CA_certificate.cer /etc/pki/ca-trust/source/anchors/Arkansas_State_University_Root_CA_certificate.crt
$ sudo cp /home/asm_service/Arkansas_State_University_Issuing_CA_certificate.cer /etc/pki/ca-trust/source/anchors/Arkansas_State_University_Issuing_CA_certificate.crt

# Update the ca trust store
$ sudo update-ca-trust extract

# Verify the certificates were added
$ trust list | grep "Arkansas State University"

# If the certificates were loaded into the trust store you should see the following output.
    label: Arkansas State University Root CA
    label: Arkansas State University Issuing CA

Debian distributions

  • Make sure that the ca-certificates package is installed

    sudo apt install ca-certificates

  • Copy the CA certificate(s) to /usr/local/share/ca-certificates/

    sudo cp CA_CERT /usr/local/share/ca-certificates/CA_CERT.crt

    Repeat for each certificate that needs to be added to the trust store.

  • Update the system certificate trust store

    sudo update-ca-certificates

  • Verify the certificates were added to the trust store

    awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)}; {print | cmd}' < /etc/ssl/certs/ca-certificates.crt | grep "My Private CA Name"

Debian example

This example uses the Arkansas State University private certificate authority.

The following files were copied to the asm_service home directory.

  • Arkansas_State_University_Root_CA_certificate.cer
  • Arkansas_State_University_Issuing_CA_certificate.cer

# Copy the certificates to the correctly directory
# Note the extension change from .cer to .crt
$ sudo cp /home/asm_service/Arkansas_State_University_Root_CA_certificate.cer /usr/local/share/ca-certificates/Arkansas_State_University_Root_CA_certificate.crt
$ sudo cp /home/asm_service/Arkansas_State_University_Issuing_CA_certificate.cer /usr/local/share/ca-certificates/Arkansas_State_University_Issuing_CA_certificate.crt

# Update the ca trust store
$ sudo update-ca-certificates

Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

# Note: you can ignore the rehash warnings about certificates 'does not contain exactly one certificate or CRL'.

# Verify the certificates were added
$ awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)}; {print | cmd}' < /etc/ssl/certs/ca-certificates.crt | grep 'Arkansas State University'

# If the certificates were loaded into the trust store you should see the following output.
subject=C=US, ST=Arkansas, L=State University, O=Arkansas State University, CN=Arkansas State University Issuing CA
subject=C=US, ST=Arkansas, L=State University, O=Arkansas State University, CN=Arkansas State University Root CA
Back to top