mirror of
https://git.launchpad.net/ubuntu/+source/ca-certificates
synced 2025-04-13 09:38:26 +00:00
100 lines
3.6 KiB
Groff
100 lines
3.6 KiB
Groff
.\" Hey, EMACS: -*- nroff -*-
|
|
.\" First parameter, NAME, should be all caps
|
|
.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
|
|
.\" other parameters are allowed: see man(7), man(1)
|
|
.TH UPDATE-CA-CERTIFICATES 8 "20 April 2003"
|
|
.\" Please adjust this date whenever revising the manpage.
|
|
.\"
|
|
.\" Some roff macros, for reference:
|
|
.\" .nh disable hyphenation
|
|
.\" .hy enable hyphenation
|
|
.\" .ad l left justify
|
|
.\" .ad b justify to both left and right margins
|
|
.\" .nf disable filling
|
|
.\" .fi enable filling
|
|
.\" .br insert line break
|
|
.\" .sp <n> insert n+1 empty lines
|
|
.\" for manpage-specific macros, see man(7)
|
|
.SH NAME
|
|
update-ca-certificates \- update /etc/ssl/certs and ca-certificates.crt
|
|
.SH SYNOPSIS
|
|
.B update-ca-certificates
|
|
.RI [ options ]
|
|
.SH DESCRIPTION
|
|
This manual page documents briefly the
|
|
.B update-ca-certificates
|
|
command.
|
|
.PP
|
|
\fBupdate-ca-certificates\fP is a program that manages the collection of
|
|
TLS certificates for the local machine and generates ca-certificates.crt.
|
|
ca-certificates.crt is a single-file of concatenated certificates.
|
|
The collection of individual certificates is stored at /etc/ssl/certs.
|
|
.PP
|
|
The program reads the configuration file /etc/ca-certificates.conf. Each line
|
|
gives a pathname of a CA certificate under /usr/share/ca-certificates that
|
|
should be trusted. Lines that begin with "#" are comment lines and thus ignored.
|
|
Lines that begin with "!" are deselected, causing the deactivation of the CA
|
|
certificate in question.
|
|
.PP
|
|
Certificates must be in PEM format and have a .crt extension in order to be
|
|
included by update-ca-certificates. Furthermore, all certificates with a .crt
|
|
extension found below /usr/local/share/ca-certificates are also included and
|
|
implicitly trusted.
|
|
.PP
|
|
To add one or more certificates to the machine, copy the certificates in PEM
|
|
format with the *.crt extension to /usr/local/share/ca-certificates. There
|
|
should be one certificate per file, and not multiple certificates in a single
|
|
file. Then run update-ca-certificates to merge the new certificates into the
|
|
existing machine store at /etc/ssl/certs.
|
|
.PP
|
|
Before terminating, \fBupdate-ca-certificates\fP invokes
|
|
\fBrun-parts\fP on /etc/ca-certificates/update.d and calls each hook with
|
|
a list of certificates: those added are prefixed with a +, those removed are
|
|
prefixed with a -.
|
|
.SH OPTIONS
|
|
A summary of options is included below.
|
|
.TP
|
|
.B \-h, \-\-help
|
|
Show summary of options.
|
|
.TP
|
|
.B \-v, \-\-verbose
|
|
Be verbose. Output \fBopenssl rehash\fP.
|
|
.TP
|
|
.B \-f, \-\-fresh
|
|
Fresh updates. Remove symlinks in /etc/ssl/certs directory.
|
|
.TP
|
|
.B \-\-certsconf
|
|
Change the configuration file. By default, the file
|
|
/etc/ca-certificates.conf is used.
|
|
.TP
|
|
.B \-\-certsdir
|
|
Change the certificate directory. By default, the directory
|
|
/usr/share/ca-certificates is used.
|
|
.TP
|
|
.B \-\-localcertsdir
|
|
Change the local certificate directory. By default, the directory
|
|
/usr/local/share/ca-certificates is used.
|
|
.TP
|
|
.B \-\-etccertsdir
|
|
Change the /etc certificate directory. By default, the directory
|
|
/etc/ssl/certs is used.
|
|
.TP
|
|
.SH FILES
|
|
.TP
|
|
.I /etc/ca-certificates.conf
|
|
A configuration file.
|
|
.TP
|
|
.I /etc/ssl/certs/ca-certificates.crt
|
|
A single-file version of CA certificates. This holds all CA certificates
|
|
that were activated in /etc/ca-certificates.conf.
|
|
.TP
|
|
.I /usr/share/ca-certificates
|
|
Directory of CA certificates provided by the distribution.
|
|
.TP
|
|
.I /usr/local/share/ca-certificates
|
|
Directory of local CA certificates, with .crt extension, provided by the user.
|
|
.SH SEE ALSO
|
|
.BR openssl (1)
|
|
.SH AUTHOR
|
|
This manual page was written by Fumitoshi UKAI <ukai@debian.or.jp>,
|
|
for the Debian project (but may be used by others).
|