Comments on: Adding SSL certificates to Google Chrome Linux (Ubuntu)

By: johntm4

johntm4 — Thu, 24 Jun 2010 13:04:06 +0000

I couldn’t get my notes in Windows Live Office to accept certificates in linux Chrome until I went to options/under the hood, scroll down to security, check ssl 2.0 and uncheck check for server certificate revocation.

By: Peter

Peter — Mon, 24 May 2010 18:12:49 +0000

Ah, sort of half figured it out (by reading the error message properly).
ipcop server browsed to with https://ipcop:445 fails as the server says it is ipcop.dcmc so browsing there with the full name works
web is harder to fix web or web.dcmc (or aliases for specific web sites) calls itself (as far as the certificate is concerned) ebox server so chromium fails to accept the cert
web:10000 says it is called * (really unhelpful) so again it fails
is there any way to convince chromium to accept the certificates?

By: Peter

Peter — Mon, 24 May 2010 18:03:18 +0000

I tried the scrip out on Kubuntu10.04 and imported certificates from 2 of my servers. One failed as there are certificates at 443 and 10000 but got round this by using server name for one import and servername.domain for the other.
All three certs are listed OK
certutil -L -d sql:$HOME/.pki/nssdb

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

ipcop CT,,
web CT,,
web.dcmc CT,,

but chromium does not recognise them – any idea why not? Or any idea where to look to find out why not?
Thanks for your help so far (it got me further than any other bit I have read yet)

By: Peter

Peter — Thu, 20 May 2010 16:27:22 +0000

Glad I could help

By: Skomli

Skomli — Thu, 20 May 2010 14:12:31 +0000

This works great. Thank you for your script! It’s really helpfull

By: G2x

G2x — Wed, 19 May 2010 18:28:00 +0000

Great script, thanks !

I kept getting the error “bad database”, so I added a few lines to the script to create the database in case it doesn’t already exist:

#!/bin/sh
#
# usage: import-cert.sh remote.host.name [port]
#

if [ ! -e $HOME/.pki/nssdb ]
then
echo “===========================
No Database found. Creating one…
=================================”
mkdir -p $HOME/.pki/nssdb
cd $HOME/.pki/nssdb
certutil -N -d sql:.
fi

REMHOST=$1
REMPORT=${2:-443}
exec 6>&1
exec > $REMHOST
echo | openssl s_client -connect ${REMHOST}:${REMPORT} 2>&1 |sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’
certutil -d sql

By: zerwas

zerwas — Tue, 11 May 2010 18:51:05 +0000

Thank you very much. Could you edit the script so certificates are deleted from ~ after execution? I don’t see why they should stay there.

By: Cougar

Cougar — Mon, 10 May 2010 10:56:17 +0000

Works fine with openSUSE too. Package for certutil is mozilla-nss-tools however.

By: GK

GK — Wed, 10 Mar 2010 09:19:05 +0000

Thanks. Very useful info

By: Martin

Martin — Wed, 03 Mar 2010 09:00:44 +0000

Excellent! Works like a charm, thak you.