Return to Answer

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/

In general CA certs should not be manually added to the local database. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser.

Procedure to add CA Certificates Manually

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

I'm unsure why adding the certificate directly into /etc/ssl/certs doesn't seem to work in the general case. The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local

Hopefully, this tested procedure works for you.

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates.

In general CA certs should not be manually added to the local trust store. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser.

All trusted CA certificates are added to a main trust store at etc/ssl/certs/ca-certificates.crt. The main trust store is updated through either through:

update-ca-certificates

or reconfiguring the ca-certificates package using:

dpkg-reconfigure ca-certificates

Procedure to add CA Certificates Manually

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local and the new certificate being added to the trust store.

Hopefully, this tested procedure works for you.

In general, the CA certificates are located in /etc/ssl/certs

You can download the CA cert and look at it with:

openssl x509 -in entrust_l1k.cer -text

And then move it into the /etc/ssl/certs directory:

sudo mv entrust_l1k.cer /etc/ssl/certs

And then update the CA certificate database:

sudo update-ca-certificates

And make sure that the cert has been added to the database.

There are also some cross-signed certs that may need to be added from the same website and in the same way.

In general CA certs should not be manually added to the local database. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser... I haven't checked my Raspbian 'Stretch' installation yet.

Correction Update

The update-ca-certificates program updates or creates logical links between /usr/share/ca-certificates/ entries and /etc/ssl/certs. If the CA cert is already in /etc/ssl/certs there is no other action that should be required to add the certificate in the general purpose search path.

Procedure That Seemed to work

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

I'm unsure why adding the certificate directly into /etc/ssl/certs doesn't seem to work in the general case. The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local

Hopefully, this tested procedure works for you.

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/

In general CA certs should not be manually added to the local database. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser.

Procedure to add CA Certificates Manually

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

I'm unsure why adding the certificate directly into /etc/ssl/certs doesn't seem to work in the general case. The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local

Hopefully, this tested procedure works for you.

In general, the CA certificates are located in /etc/ssl/certs

You can download the CA cert and look at it with:

openssl x509 -in entrust_l1k.cer -text

And then move it into the /etc/ssl/certs directory:

sudo mv entrust_l1k.cer /etc/ssl/certs

And then update the CA certificate database:

sudo update-ca-certificates

And make sure that the cert has been added to the database.

There are also some cross-signed certs that may need to be added from the same website and in the same way.

In general CA certs should not be manually added to the local database. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser... I haven't checked my Raspbian 'Stretch' installation yet.

Correction Update

The update-ca-certificates program updates or creates logical links between /usr/share/ca-certificates/ entries and /etc/ssl/certs. If the CA cert is already in /etc/ssl/certs there is no other action that should be required to add the certificate in the general purpose search path.

In general, the CA certificates are located in /etc/ssl/certs

You can download the CA cert and look at it with:

openssl x509 -in entrust_l1k.cer -text

And then move it into the /etc/ssl/certs directory:

sudo mv entrust_l1k.cer /etc/ssl/certs

And then update the CA certificate database:

sudo update-ca-certificates

And make sure that the cert has been added to the database.

There are also some cross-signed certs that may need to be added from the same website and in the same way.

In general CA certs should not be manually added to the local database. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser... I haven't checked my Raspbian 'Stretch' installation yet.

Correction Update

The update-ca-certificates program updates or creates logical links between /usr/share/ca-certificates/ entries and /etc/ssl/certs. If the CA cert is already in /etc/ssl/certs there is no other action that should be required to add the certificate in the general purpose search path.

Procedure That Seemed to work

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

I'm unsure why adding the certificate directly into /etc/ssl/certs doesn't seem to work in the general case. The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local

Hopefully, this tested procedure works for you.