Content-type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE>Man page of UPDATE-CA-CERTIFICATES</TITLE>
</HEAD><BODY>
<H1>UPDATE-CA-CERTIFICATES</H1>
Section: Maintenance Commands (8)<BR>Updated: 20 April 2003<BR><A HREF="#index">Index</A>
<A HREF="index.html">Return to Main Contents</A><HR>













<A NAME="lbAB">&nbsp;</A>
<H2>NAME</H2>

update-ca-certificates - update /etc/ssl/certs and ca-certificates.crt
<A NAME="lbAC">&nbsp;</A>
<H2>SYNOPSIS</H2>

<B>update-ca-certificates</B>

[<I>options</I>]

<A NAME="lbAD">&nbsp;</A>
<H2>DESCRIPTION</H2>

This manual page documents briefly the
<B>update-ca-certificates</B>

command.
<P>

<B>update-ca-certificates</B> is a program that manages the collection of
TLS certificates for the local machine and generates ca-certificates.crt.
ca-certificates.crt is a single-file of concatenated certificates.
The collection of individual certificates is stored at /etc/ssl/certs.
<P>

The program reads the configuration file /etc/ca-certificates.conf. Each line
gives a pathname of a CA certificate under /usr/share/ca-certificates that
should be trusted. Lines that begin with &quot;#&quot; are comment lines and thus ignored.
Lines that begin with &quot;!&quot; are deselected, causing the deactivation of the CA
certificate in question.
<P>

Certificates must be in PEM format and have a .crt extension in order to be
included by update-ca-certificates. Furthermore, all certificates with a .crt
extension found below /usr/local/share/ca-certificates are also included and
implicitly trusted.
<P>

To add one or more certificates to the machine, copy the certificates in PEM
format with the *.crt extension to /usr/local/share/ca-certificates. There
should be one certificate per file, and not multiple certificates in a single
file. Then run update-ca-certificates to merge the new certificates into the
existing machine store at /etc/ssl/certs.
<P>

Before terminating, <B>update-ca-certificates</B> invokes
<B>run-parts</B> on /etc/ca-certificates/update.d and calls each hook with
a list of certificates: those added are prefixed with a +, those removed are
prefixed with a -.
<A NAME="lbAE">&nbsp;</A>
<H2>OPTIONS</H2>

A summary of options is included below.
<DL COMPACT>
<DT><B>-h, --help</B>

<DD>
Show summary of options.
<DT><B>-v, --verbose</B>

<DD>
Be verbose. Output <B>openssl rehash</B>.
<DT><B>-f, --fresh</B>

<DD>
Fresh updates.  Remove symlinks in /etc/ssl/certs directory.
<DT><B>--certsconf</B>

<DD>
Change the configuration file. By default, the file
/etc/ca-certificates.conf is used.
<DT><B>--certsdir</B>

<DD>
Change the certificate directory. By default, the directory
/usr/share/ca-certificates is used.
<DT><B>--localcertsdir</B>

<DD>
Change the local certificate directory. By default, the directory
/usr/local/share/ca-certificates is used.
<DT><B>--etccertsdir</B>

<DD>
Change the /etc certificate directory. By default, the directory
/etc/ssl/certs is used.
<DT></DL>
<A NAME="lbAF">&nbsp;</A>
<H2>FILES</H2>

<DD>
<DL COMPACT>
<DT><I>/etc/ca-certificates.conf</I>

<DD>
A configuration file.
<DT><I>/etc/ssl/certs/ca-certificates.crt</I>

<DD>
A single-file version of CA certificates. This holds all CA certificates
that were activated in /etc/ca-certificates.conf.
<DT><I>/usr/share/ca-certificates</I>

<DD>
Directory of CA certificates provided by the distribution.
<DT><I>/usr/local/share/ca-certificates</I>

<DD>
Directory of local CA certificates, with .crt extension, provided by the user.
</DL>
<A NAME="lbAG">&nbsp;</A>
<H2>SEE ALSO</H2>

<B><A HREF="openssl.1.html">openssl</A></B>(1)

<A NAME="lbAH">&nbsp;</A>
<H2>AUTHOR</H2>

This manual page was written by Fumitoshi UKAI &lt;<A HREF="mailto:ukai@debian.or.jp">ukai@debian.or.jp</A>&gt;,
for the Debian project (but may be used by others).
<P>

<HR>
<A NAME="index">&nbsp;</A><H2>Index</H2>
<DL>
<DT><A HREF="#lbAB">NAME</A><DD>
<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
<DT><A HREF="#lbAE">OPTIONS</A><DD>
<DT><A HREF="#lbAF">FILES</A><DD>
<DT><A HREF="#lbAG">SEE ALSO</A><DD>
<DT><A HREF="#lbAH">AUTHOR</A><DD>
</DL>
<HR>
This document was created by
<A HREF="index.html">man2html</A>,
using the manual pages.<BR>
Time: 11:39:59 GMT, September 14, 2026
</BODY>
</HTML>