update-ca-trust utility to manage these entries, which are stored in specific directories under /etc/pki/ca-trust.
Understanding the CA Trust Store Structure
RHEL 9 utilizes a modular certificate trust store system. Unlike older distributions that relied on a single monolithic file, RHEL separates source certificates into distinct directories based on their intended use. This separation allows for granular control over which certificates are trusted by different types of applications. The primary directory for user-installed or custom CA certificates is/etc/pki/ca-trust/source/anchors. When administrators place a PEM-encoded certificate file in this directory, it becomes available for system-wide trust evaluation after the trust store is updated.
Another critical directory is /etc/pki/ca-trust/source/blacklist. Certificates placed here are explicitly excluded from the trust store, preventing them from being used for validation even if they appear in other locations. This mechanism provides a robust way to revoke trust in specific, potentially compromised or untrusted CAs without removing them entirely from the filesystem. Understanding this structure is essential before attempting any configuration changes.
Adding Custom Certificates to the Trust List
To add a new trusted Certificate Authority, you must first obtain the PEM-formatted certificate file. This file usually contains the public key and identity information of the CA. Place this file directly into the/etc/pki/ca-trust/source/anchors directory. It is important to ensure the file permissions are set correctly, typically allowing root access while restricting write permissions to prevent unauthorized modifications. For example, you might copy a certificate named my-custom-ca.pem using standard file management commands.
Once the certificate file is in place, the system does not immediately recognize it. You must trigger the trust store update process. This step compiles all sources into the final binary database files located in /etc/pki/ca-trust/extracted/. Running the update command processes every file in the anchors directory, validates its format, and integrates it into the global trust pool. This ensures that subsequent cryptographic operations can locate and utilize the newly added CA.
Updating the Trust Database
The core command for managing the trust list in RHEL 9 isupdate-ca-trust. This utility scans the various source directories and regenerates the extracted trust stores. To apply changes made to the anchors directory, execute the following command with administrative privileges:
sudo update-ca-trust extract/etc/pki/ca-trust/source/anchors, /etc/pki/ca-trust/source/blacklist, and other configured sources. It then writes the consolidated data into the output directories. If the command completes without error, the trust list has been successfully updated. You can verify the operation by checking the modification timestamps of the files in /etc/pki/ca-trust/extracted/. These files should reflect the time when the extraction occurred.
Verifying Certificate Trust
After updating the trust store, it is crucial to verify that the certificate is recognized. One method is to inspect the extracted trust store files directly, although this is less practical for large systems. A more effective approach is to test an application that relies on SSL/TLS verification. For instance, you can usecurl or openssl to connect to a server secured by your custom CA. If the connection succeeds without manual override flags, the certificate is correctly trusted.
You can also use the openssl verify command to check the trust chain manually. Provide the path to the target certificate and the CA bundle. If the verification returns "OK", the system trusts the certificate. If it fails, review the blacklist directory and ensure the certificate was properly formatted and placed in the anchors directory. Incorrect formatting, such as missing headers or invalid base64 encoding, will cause the update process to skip the file silently.
Managing Blacklisted Certificates
In some security scenarios, you may need to distrust a previously trusted CA. This is achieved by moving the certificate file to the/etc/pki/ca-trust/source/blacklist directory. Once moved, run update-ca-trust extract again. This action removes the certificate from the active trust store, effectively revoking its authority. Applications will subsequently fail to validate chains involving this CA, triggering security warnings. This feature is vital for maintaining strict security postures and responding to CA compromises.
Integrating with System Services
Many system services, including web servers and mail daemons, rely on the system-wide trust store. After configuring the trust list, these services do not typically require restarts unless they cache certificate data at startup. However, services like Nginx or Apache may benefit from a reload to pick up any changes in certificate validation behavior. Always consult the documentation for specific services to determine if a restart is necessary. Proper integration ensures that security configurations propagate across the entire operating system. For further reading on related security configurations, you might find Improving NFS Server Security on a Local Network helpful for understanding broader network security contexts. Additionally, reviewing Enforcing Maximum Authentication Time in OpenSSH Configuration can complement your overall security hardening strategy.Frequently Asked Questions
How do I remove a certificate from the trust list?
To remove a certificate, delete it from the /etc/pki/ca-trust/source/anchors directory. Alternatively, move it to the blacklist directory to explicitly exclude it. After making these changes, run sudo update-ca-trust extract to apply the removal.
Why is my certificate not trusted after adding it?
This often happens because the trust store was not updated after placing the file. Ensure you run update-ca-trust extract and verify the file is in PEM format. Check for syntax errors in the certificate file that might cause the updater to skip it.
Can I use DER format certificates instead of PEM?
The update-ca-trust utility primarily expects PEM-encoded certificates in the anchors directory. If you have DER-format certificates, you must convert them to PEM using OpenSSL before placing them in the trust source directories.
Does updating the trust store affect existing SSL sessions?
No, existing active sessions are not affected. New connections established after the update will use the new trust store. Services that cache trust data may require a restart or reload to fully integrate the changes.
Where are the compiled trust store files located?
The compiled trust store files are located in /etc/pki/ca-trust/extracted/. This directory contains the final databases used by applications to perform certificate validation. Do not edit these files manually; always use update-ca-trust to modify them.