11

I have a very noob problem with my Raspberry Pi 3b (all updated to latest stable version available). I want to use it to automate some scripts I've written in R that run smoothly on my Win10 machine under R 3.4.3 within RStudio. As I move to the command line of the RPi, I get an error concerning certificates when R tries to download some file from the philadelphiafed.org website. This error reads 

Error in download.file("https://www.philadelphiafed.org/-/media/research-and-data/real-time-center/greenbook-data/documentation/gbweb_row_format.xls?la=en",  : cannot download all files
Calls: source -> withVisible -> eval -> eval -> download.file
In addition: Warning message:
In download.file("https://www.philadelphiafed.org/-/media/research-and-data/real-time-center/greenbook-data/documentation/gbweb_row_format.xls?la=en",  : URL 'https://www.philadelphiafed.org/-/media/research-and-data/real-time-center/greenbook-data/documentation/gbweb_row_format.xls?la=en': 
status was 'Peer certificate cannot be authenticated with given CA certificates'

Given that the problem concerns CA certificates, I verified those that the Philly Fed site uses, it turns out I need to install the Entrusted L1K certificate I found here so to solve this issue. The noob question is then how do I install these certificates and tell the RPi to include them in its library? Any help is much appreciated!

Improve this question

2 Answers 2

Reset to default
19

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates.

In general CA certs should not be manually added to the local trust store. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in Raspbian. It seems to be included in my Debian 'Buster' installation running Brave Browser.

All trusted CA certificates are added to a main trust store at etc/ssl/certs/ca-certificates.crt. The main trust store is updated through either through:

update-ca-certificates

or reconfiguring the ca-certificates package using:

dpkg-reconfigure ca-certificates

Procedure to add CA Certificates Manually

It's been awhile since I manually updated CA certs on a client machine. The following procedure worked on my Raspberry Pi running Raspbian Stretch:

Create a local cert directory:

mkdir /usr/share/ca-certificates/local

Download the CA cert:

cd /usr/share/ca-certificates/local
wget https://entrust.com/root-certificates/entrust_l1k.cer

Reformat the certificate into PEM:

openssl x509 -inform PEM  -in entrust_l1k.cer -outform PEM -out entrust_l1k.crt

Reconfigure the ca-certificates package:

dpkg-reconfigure ca-certificates

When prompted for what do to with new certificates, choose ask. And then select the entrust_l1k.crt with space.

Test that it works:

lynx https://www.philadelphiafed.org

And/or:

openssl s_client -connect www.philadelphiafed.org:443

The result of the working procedure is a logical link in /etc/ssl/certs to the certificate in /usr/share/ca-certificates/local and the new certificate being added to the trust store.

Hopefully, this tested procedure works for you.

Improve this answer
4
  • Thank you! I will test your solution shortly and come back to you! The strange thing is that this error came up right after the last release of the Debian version, by the end of November if I recall correctly. Before the update it worked properly.
    – Ceschi
    Commented Dec 13, 2017 at 15:29
  • IT WORKS! Perfect @RubberStamp, you literally saved hours of work!
    – Ceschi
    Commented Dec 13, 2017 at 18:38
  • My certificate was the correct format but dpkg-reconfigure ca-certificates didn't list it till I changed the extension of the file to .crt
    – M-Dahab
    Commented Jul 27, 2021 at 9:36
  • This works fine with the openssl CLI, however if you visit the same FQDN in the Chromium browser it will not. There must be a detachment between Chromium and the operating system's trusted CA storage.
    – Adambean
    Commented Feb 23 at 9:52
4

In Raspbian GNU/Linux 9.4 (stretch) your local CA certificates should be placed in /usr/local/share/ca-certificates to be added to /etc/ssl/certs/ca-certificates.crt. These should have a .crt extension. see man update-ca-certificates

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.