RHEL6/7更新系统的CA

操作系统

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7

问题

• 如何更新RHEL6/7 系统级别的信任的证书的list

方案

以root的权限去添加新的CA到信任证书的系统级的数据库中是非常简单的。

执行以下操作步骤确保数据中仅含有默认的证书

1. 创建备份目录，用来存在所有现存的证书，以便后续debug.

~]# mkdir -p /root/cert.bak
mkdir: created directory ‘/root/cert.bak’

2. 重置和更新‘ca-certificates’包

# 这会重置ca-bundle.crt，备份原文件以及安装新包
~]# rpm -Vv ca-certificates | awk '$1!="........." && $2!="d" {system("mv -v " $NF " /root/cert.bak")}'
`/etc/pki/java/cacerts' -> `/root/cert.bak/cacerts'
`/etc/pki/tls/certs/ca-bundle.crt' -> `/root/cert.bak/ca-bundle.crt'
`/etc/pki/tls/certs/ca-bundle.trust.crt' -> `/root/cert.bak/ca-bundle.trust.crt'
~]# yum check-update ca-certificates; (($?==100)) && yum update ca-certificates || yum reinstall ca-certificates

3. 确保'/etc/pke/ca-trust/source'和‘/etc/pki/ca-trust/source/anchors/’共含有两个文件。若有其他文件，可手动移动到备份目录。

~]# find /etc/pki/ca-trust/source{,/anchors} -maxdepth 1 -not -type d -exec ls -1 {} +
/etc/pki/ca-trust/source/ca-bundle.legacy.crt
/etc/pki/ca-trust/source/README

4. 确保“/usr/share/pki/ca-trust-source”和‘/usr/share/pki/ca-trust/source/’共包含4个文件（RHEL7.4+只包含其中的两个）

~]# find /usr/share/pki/ca-trust-source{,/anchors} -maxdepth 1 -not -type d -exec ls -1 {} +
/usr/share/pki/ca-trust-source/ca-bundle.neutral-trust.crt
/usr/share/pki/ca-trust-source/ca-bundle.supplement.p11-kit
/usr/share/pki/ca-trust-source/ca-bundle.trust.crt
/usr/share/pki/ca-trust-source/README

5. 使用'updata-ca-trust'命令重新编译CA-trust的数据库

-]# update-ca-trust extract

RHEL-6的系统你可能会遇到以下信息（可忽略该信息）：
update-ca-trust: Warning: The dynamic CA configuration feature is in the disabled stat