Complete Guide to Adding Certificate Authority Files in CentOS 7

Introduction

In CentOS 7 systems, proper configuration of Certificate Authority (CA) files is crucial for establishing secure SSL/TLS connections. Many system administrators encounter failures when adding certificates, often due to insufficient understanding of certificate trust mechanisms or incorrect operational procedures. This article analyzes correct CA certificate addition methods based on real-world cases.

Problem Analysis

From user-reported cases, a common error scenario emerges: users copy the ca.crt file to the /etc/pki/ca-trust/source/anchors/ directory, execute the update-ca-trust extract command, but find that the CA certificate hasn't been successfully added when checking the /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt file.

Correct Operational Workflow

Based on best practices and verified solutions, the correct CA certificate addition workflow is as follows:

First, copy the CA certificate file to the designated trust storage directory:

cp ca.crt /etc/pki/ca-trust/source/anchors/

Then, execute the certificate trust update command:

update-ca-trust

In-Depth Technical Principles

CentOS 7's certificate trust system is based on a hierarchical storage architecture. The /etc/pki/ca-trust/source/anchors/ directory stores user-added CA certificates, which have the highest priority in the system trust chain. When the update-ca-trust command is executed, the system:

1. Scans certificate files in all trust source directories
2. Validates certificate format and authenticity
3. Merges valid certificates into unified trust storage files
4. Generates certificate bundles for different applications

The following code example demonstrates how to programmatically verify successful certificate addition:

#!/bin/bash
# Verify if CA certificate has been successfully added to trust storage
echo "Checking if certificate file exists..."
if [ -f "/etc/pki/ca-trust/source/anchors/ca.crt" ]; then
    echo "Certificate file correctly placed"
else
    echo "Error: Certificate file not found"
    exit 1
fi

echo "Executing trust update..."
update-ca-trust

echo "Verifying if certificate is in trust bundle..."
if grep -q "BEGIN CERTIFICATE" /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt; then
    echo "Certificate trust update successful"
else
    echo "Warning: Certificate may not have been added correctly"
fi

Common Issues and Solutions

Issue 1: Incorrect Certificate Format

Ensure the CA certificate file uses the correct PEM format, containing <span class="html-entity">&lt;</span> and <span class="html-entity">&lt;</span> markers.

sudo cp ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

openssl x509 -in ca.crt -text -noout

update-ca-trust enable

grep -A 20 "Your CA Name" /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

curl --cacert /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt https://your-server.com