Arch Linux

MaSydJun

Member

Registered: 2013-05-25

Posts: 12

[SOLVED] Can't trust a self-signed SSL certificate

Hey guys,

it feels like already searched through the whole internet, but I can't find a solution that is working.
My scenario is this:
I connect to a network via VPN.
In the network, there is a website that uses a self-signed certificate.
I want to trust this specific certificate in order to avoid annoying browser warnings (I'm using Chrome/Brave).

Now, I downloaded the certificate via the openssl command:

echo -n | openssl s_client -connect ${DOMAIN}:${PORT} 2> /dev/null | \
sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > $TEMP_CERT

What I tried so far:
1)
I used trust to trust the certificate:

sudo trust anchor --store $TEMP_CERT

This stores the certificate with a bunch of meta data in a file in /etc/ca-certificates/trust-source/. This also leads to trust list showing me the certificate that I previously added (the category is other-entry however, unlike the other entries).
I thought this would be enough, so I restarted my browser and entered the URL. My browser however, tells me the connection is not secure (self-signed certificate). So double checked with curl, same result:

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: [url]https://curl.haxx.se/docs/sslcerts.html[/url]

2)
While googling I stumbled upon a couple of threads and basically everyone referred to this post: https://www.archlinux.org/news/ca-certificates-update/
So I tried copying my .crt file - that I downloaded via the openssl command - to /etc/ca-certificates/trust-source/anchors/ and executing sudo update-ca-trust.
I also tried the following combinations:

sudo trust extract-compat
sudo update-ca-trust extract
sudo update-ca-trust extract-compat

This all lead to the same result: My browser and curl seem to not recognize the certificate.

3)
Using curl and explicitly specifying the certificate on the command line:

curl --cacert ~/.certs/some-local-certificate.crt [url]https://some-domain.com[/url]

This actually works, however is not an acceptable workaround for me, since I want to use a web browser to browse the website.

4)
I manually added the certificate data to /etc/ssl/certs/ca-certificates.crt (as root):

cat .certs/some-local-certificate.crt >> /etc/ssl/certs/ca-certificates.crt

This actually works too, however after executing `update-ca-trust` this change is gone and I would have to manually add it again. Also this seems to be a rather dirty solution to me.

Can anyone relate? I would really write a script to automate this process, however I'm stuck with actually trusting the certificate...

This is my script so far, if anyone is curious:

#!/bin/bash

function step {
    echo "$1:"
}

function result {
    if [ $? -eq 0 ]; then
        echo "  => SUCCESS"
    else
        echo "  => FAILED"
        exit 1
    fi
}

DOMAIN="$1"
PORT="443"
LOCAL_CERT_STORE="${HOME}/.certs"
CERT_NAME="${DOMAIN}.crt"
TEMP_CERT="/tmp/$CERT_NAME"

if [ -z "$DOMAIN" ]; then
  echo "ERROR: Expecting domain name as first argument"
  exit 1
fi

step "Downloading certificate from \"${DOMAIN}\" (port: ${PORT})"
echo -n | openssl s_client -connect ${DOMAIN}:${PORT} 2> /dev/null | \
sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > "$TEMP_CERT"
result

mkdir -p "$LOCAL_CERT_STORE"
cp "$TEMP_CERT" "$LOCAL_CERT_STORE"

step "Importing certificate \"${LOCAL_CERT_STORE}/${CERT_NAME}\" (requires root)"
sudo trust anchor --store "${LOCAL_CERT_STORE}/${CERT_NAME}"
result

step "Updating CA trust"
sudo update-ca-trust extract
result

Thanks in advance!

Regards

Last edited by MaSydJun (2020-05-15 10:00:53)

gsgleason

Member

Registered: 2012-10-08

Posts: 72

Re: [SOLVED] Can't trust a self-signed SSL certificate

Browsers often use their own internal trust store.  Add it through the browser.

MaSydJun

Member

Registered: 2013-05-25

Posts: 12

Re: [SOLVED] Can't trust a self-signed SSL certificate

Actually I forgot to mention. I already tried trusting the certificate via Brave, but it still did not work. It seemed however Brave successfully imported the certificate, very strange.

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] Can't trust a self-signed SSL certificate

Well probably you certificate is not a CA. Is that site yours than download / create the CA and import that into your trusted store, should work.
These kind of chains of trust work for things like Nextcloud/client and Mozilla browsers, I don't use Chrome based browsers, try it...

edit: for browsers the system trusted store may not work, import the CA into the browser...

Last edited by qinohe (2020-05-14 11:49:29)

MaSydJun

Member

Registered: 2013-05-25

Posts: 12

Re: [SOLVED] Can't trust a self-signed SSL certificate

Yes you are right, the certificate is not a CA. However I still would like to trust this specific certificate. Unfortunately I'm not the "owner" of this certificate so I'm not able create my own certificate and sign it with a custom CA.
Unfortunately this is beyond my knowledge. I thought it would be able to trust one single certificate without any CA.

I was able to add a permanent exception in Firefox for the domain and this actually works. However I'd like to use brave instead, but brave seems to not allow an "exception"...

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] Can't trust a self-signed SSL certificate

Not much you can do about it.
One thing to mention is it is very insecure way to connect to whatever server it is, you'd like that chain of trust...
Unless you're the one owning the chain(which isn't the case) you really need to be sure you can trust it's owners..

Since you mention you log in on that specific network trough VPN you may know it's admin's personally(doesn't have to be the case...), but if so try to convince them to setup a chain of trust.
Again, not that it gets much safer but it's better than situation your in now.

MaSydJun

Member

Registered: 2013-05-25

Posts: 12

Re: [SOLVED] Can't trust a self-signed SSL certificate

Thanks for clarifying this, man. I realized I banged my had against the wall by trying to achieve something that is not really supposed to work.

MaSydJun

Member

Registered: 2013-05-25

Posts: 12

Re: [SOLVED] Can't trust a self-signed SSL certificate

Good news, I solved it! Also thanks to qinohe's answers.
I realized I had to import a CA certificate instead of the "non-CA" certificate (maybe there is a special term for this).
I then opened up the details of the "non-CA" certificate in my browser. The details view spit out a bunch of URLs, one of which referred to a crt-file.
I copied the URL and downloaded the CA crt file via curl:

curl http://ca.some-url.com/cert/some-file-name-ca.crt -o some-file-name-ca.crt

I then imported the downloaded CA certificate via trust:

sudo trust anchor --store some-file-name-ca.crt
sudo update-ca-trust extract

I restarted my borwser, entered the URL of the website, connection now is secure!

Regards

Last edited by MaSydJun (2020-05-15 10:01:18)

gsgleason

Member

Registered: 2012-10-08

Posts: 72

Re: [SOLVED] Can't trust a self-signed SSL certificate

Since you mentioned it was a self-signed certificate, there is no CA, nor a chain.

So you saved the server's self-signed certificate as a trusted CA, yes?

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] Can't trust a self-signed SSL certificate

@gsgleason, no, you can't save a single certificate as CA.

Read post #8 again and see you interpreted it your way for OP did infarct install a CA;)...