This howto describes how to add a Certificate Authority (CA) to your Debian system without mixing it with the CA certificates that Debian provides.

This way a Debian update won’t replace it, but the CA will be recognized by the OS’s tools.

Certificate installation and activation

  1. Place your CA certificate into the folder /usr/local/share/ca-certificates/.
    Each CA certificate must be in an own file, in PEM-encoded format and with a filename ending with .crt.

  2. Integrate the new CA certificate into the system with

    update-ca-certificates

Additional information

With the command

dpkg-reconfigure ca-certificate

you can chose, which CA certificates provided by the distribution should be trusted and which not.