mirror of
https://git.launchpad.net/ubuntu/+source/ca-certificates
synced 2025-04-13 09:38:26 +00:00
81 lines
3 KiB
Text
81 lines
3 KiB
Text
The Debian Package ca-certificates-local
|
|
----------------------------
|
|
|
|
This package includes local CA certificates to be installed in
|
|
/usr/local/share/ca-certificates. The CA certificates installed by this
|
|
package will be implicitly trusted.
|
|
|
|
This is an example stub source package that includes a dummy CA
|
|
certificate in the local/ directory. Remove the dummy certificate, copy
|
|
your trusted local root CA (in PEM format with the filename ending in
|
|
".crt") to the local/ directory, edit files in the debian/ directory as
|
|
desired, and build your custom package.
|
|
|
|
----------------------------
|
|
|
|
Steps to build your custom local root CA package from this example:
|
|
|
|
- Check that your local root CA is in PEM-encoded format, the filename
|
|
ends in ".crt", and that it is properly usable by openssl; for example:
|
|
|
|
$ openssl x509 -text -in Deep_Thought_Dummy_Root_CA.crt
|
|
Certificate:
|
|
Data:
|
|
Version: 3 (0x2)
|
|
Serial Number: 66 (0x42)
|
|
Signature Algorithm: sha1WithRSAEncryption
|
|
Issuer: CN=Deep Thought Dummy Root CA
|
|
Validity
|
|
Not Before: Aug 29 00:00:00 2013 GMT
|
|
Not After : Aug 28 23:59:59 2042 GMT
|
|
Subject: CN=Deep Thought Dummy Root CA
|
|
Subject Public Key Info:
|
|
Public Key Algorithm: rsaEncryption
|
|
Public-Key: (1024 bit)
|
|
Modulus:
|
|
00:a2:e3:00:b0:d2:fa:92:57:02:97:5e:80:e0:1a:
|
|
<...>
|
|
c5:6e:dc:50:7f:3f:34:b8:29
|
|
Exponent: 65537 (0x10001)
|
|
X509v3 extensions:
|
|
X509v3 Basic Constraints: critical
|
|
CA:TRUE
|
|
X509v3 Subject Key Identifier:
|
|
C3:FF:DB:49:E2:8A:A4:26:62:19:74:F0:66:41:E1:5F:F7:4B:3F:A7
|
|
X509v3 Key Usage:
|
|
Certificate Sign, CRL Sign
|
|
Netscape Cert Type:
|
|
SSL CA, S/MIME CA, Object Signing CA
|
|
Signature Algorithm: sha1WithRSAEncryption
|
|
1f:32:49:f2:7f:ed:80:62:2e:49:b7:ce:84:b9:c1:c5:1a:f6:
|
|
<...>
|
|
32:2d
|
|
-----BEGIN CERTIFICATE-----
|
|
MIICEjCCAXugAwIBAgIBQjANBgkqhkiG9w0BAQUFADAlMSMwIQYDVQQDExpEZWVw
|
|
<...>
|
|
yTxhjDIt
|
|
-----END CERTIFICATE-----
|
|
|
|
- Copy this example source package somewhere to build as a normal user,
|
|
for instance your home directory:
|
|
|
|
$ cp -a /usr/share/doc/ca-certificates/examples/ca-certificates-local ~/
|
|
$ cd ~/ca-certificates-local/
|
|
|
|
- Remove the dummy CA certificate, copy your local root CA certificate(s)
|
|
to the local/ directory, and build the package:
|
|
|
|
$ rm local/Local_Root_CA.crt
|
|
$ cp /path/to/YourOrg_Root_CA.crt local/
|
|
$ dpkg-buildpackage
|
|
|
|
- Install the package (or copy it to your local apt repository for
|
|
installation on lots of machines):
|
|
|
|
$ sudo dpkg -i ../ca-certificates-local_0.1_all.deb
|
|
|
|
- Feel free to edit the files under the debian/ directory for items like
|
|
the maintainer name and email address, version, etc. to better reflect
|
|
your own organization. This is just an example to get you started with
|
|
a proper local root CA package.
|
|
|