{"id":15515,"date":"2023-02-26T22:46:23","date_gmt":"2023-02-26T19:46:23","guid":{"rendered":"https:\/\/kifarunix.com\/?p=15515"},"modified":"2024-03-10T08:16:09","modified_gmt":"2024-03-10T05:16:09","slug":"how-to-setup-a-local-ca-server-on-ubuntu","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-setup-a-local-ca-server-on-ubuntu\/","title":{"rendered":"How to Setup a Local CA Server on Ubuntu"},"content":{"rendered":"\n<p>How do I set up a local certificate authority server on Linux? Well, in this tutorial you will learn how to setup a Local CA Server on Ubuntu. You might want to setup a Local CA server for various reasons including to issue private certificates for your users and applications. This will also see you cut costs on the purchases of public certs required for your local usage, as well as giving you control over the digital certificates you issue for local use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Setting up a Local CA Server on Ubuntu<\/h2>\n\n\n\n<p>In order to setup a local CA (Certificate Authority) server on Linux:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install OpenSSL on Ubuntu<\/h3>\n\n\n\n<p>OpenSSL part of the OpenSSL project&#8217;s implementation of the SSL and TLS cryptographic protocols for secure communication over the<br>Internet. It contains the general-purpose command line binary <strong><code>\/usr\/bin\/openssl<\/code><\/strong>, useful for cryptographic operations such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>creating RSA, DH, and DSA key parameters;<\/li>\n\n\n\n<li>creating X.509 certificates, CSRs, and CRLs;<\/li>\n\n\n\n<li>calculating message digests;<\/li>\n\n\n\n<li>encrypting and decrypting with ciphers;<\/li>\n\n\n\n<li>testing SSL\/TLS clients and servers;<\/li>\n\n\n\n<li>handling S\/MIME signed or encrypted mail.<\/li>\n<\/ul>\n\n\n\n<p>The OpenSSL command line binary is usually installed on Linux systems by default. You can check if the binary is available by running the command;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>which openssl<\/code><\/pre>\n\n\n\n<p>It should list the path to binary if the package is installed;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/openssl<\/code><\/pre>\n\n\n\n<p>If for some unknown reasons the binary is not available, then you can install it by running the command below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install openssl<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Create Directories and Configuration files for your CA<\/h3>\n\n\n\n<p>OpenSSL uses <code>openssl.cnf<\/code> configuration file to define and specify various settings and options when generating digital certificates, private keys, and other cryptographic objects.<\/p>\n\n\n\n<p>First of all, create a root CA directory to store your CA issued certificates, CA&#8217;s private key, certificate requests&#8230;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p \/etc\/ssl\/kifarunixCA\/{certs,private,crl,newcerts,csr}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Update some OpenSSL CA Settings in openssl.cnf file<\/h3>\n\n\n\n<p>We need to make a few customizations of OpenSSL CA settings such as;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Default certificate and private key locations<\/li>\n\n\n\n<li>Default certificate authority (CA) information<\/li>\n\n\n\n<li>Default encryption algorithms and key lengths<\/li>\n\n\n\n<li>Default certificate signing request (CSR) options<\/li>\n\n\n\n<li>etc<\/li>\n<\/ul>\n\n\n\n<p>Thus, copy the default <code>openssl.cnf<\/code> configuration file to your directory;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp \/etc\/ssl\/openssl.cnf \/etc\/ssl\/kifarunixCA\/<\/code><\/pre>\n\n\n\n<p>Open your custom openssl.cnf file and edit the <code><strong>[ CA_default ]<\/strong><\/code>, <strong><code>[ req ]<\/code><\/strong>, <strong><code>[ req_distinguished_name ]<\/code><\/strong> and <strong><code>[ usr_cert ]<\/code><\/strong> sections. See our customized sections below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim \/etc\/ssl\/kifarunixCA\/openssl.cnf<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>[ ca ]\ndefault_ca      = CA_default\n\n<strong>[ CA_default ]<\/strong>\n\ndir             = <strong>\/etc\/ssl\/kifarunixCA<\/strong>\ncerts           = $dir\/certs\ncrl_dir         = $dir\/crl              \ndatabase        = $dir\/index.txt\n                            \nnew_certs_dir   = $dir\/newcerts\n\ncertificate     = $dir\/cacert.pem\nserial          = $dir\/serial\ncrlnumber       = $dir\/crlnumber        \n                                        \ncrl             = $dir\/crl.pem\nprivate_key     = $dir\/private\/cakey.pem        \n\nx509_extensions = usr_cert              \n\nname_opt        = ca_default\ncert_opt        = ca_default            \n\n\n                                        \n<strong>default_days    = 3650 <\/strong>                 \ndefault_crl_days= 30                    \ndefault_md      = default\npreserve        = no      \n\npolicy          = policy_match\n\n...\n<strong>[ req ]<\/strong>\n<strong>default_bits            = 4096<\/strong>\n\n...\n<strong>[ req_distinguished_name ]<\/strong>\ncountryName                     = Country Name (2 letter code)\ncountryName_default             = US\ncountryName_min                 = 2\ncountryName_max                 = 2\n\nstateOrProvinceName             = State or Province Name (full name)\nstateOrProvinceName_default     = California\n\nlocalityName                    = Locality Name (eg, city)\nlocalityName_default            = San Francisco\n\n0.organizationName              = Organization Name (eg, company)\n0.organizationName_default      = Kifarunix, Inc.\n\norganizationalUnitName          = Organizational Unit Name (eg, section)\norganizationalUnitName_default  = IT Department\n\ncommonName                      = Common Name (e.g. server FQDN or YOUR name)\ncommonName_max                  = 64\n\nemailAddress                    = Email Address\nemailAddress_max                = 64\n...\n<strong>[ usr_cert ]\nbasicConstraints=CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\nsubjectAltName = @alt_names\n[alt_names] \nDNS.1 = *.kifarunix.com<\/strong>\n<\/code><\/pre>\n\n\n\n<p>We also customized the <code><strong>req_distinguished_name<\/strong><\/code> section to update the default information about our CA entity. You can leave it so you can supply the information manually or via the <code>-subj<\/code> openssl command line option e.g;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-subj \"\/C=US\/ST=CA\/L=San Francisco\/O=Kifarunix, Inc.\/CN=kifarunix.com\"<\/code><\/pre>\n\n\n\n<p>Save and exit the file. Refer to <a href=\"https:\/\/www.openssl.org\/docs\/\" target=\"_blank\" rel=\"noreferrer noopener\">OpenSSL Docs<\/a> for more info.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Initialize the CA Database<\/h3>\n\n\n\n<p>Initialize the&nbsp;<code>serial<\/code>&nbsp;(<em>Contains the serial number for the next certificate<\/em>) file and create the&nbsp;<code>index.txt<\/code> (<em>Used as a database to track certificates that have been issued<\/em>);<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo 01 &gt; \/etc\/ssl\/kifarunixCA\/serial<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>touch \/etc\/ssl\/kifarunixCA\/index.txt<\/code><\/pre>\n\n\n\n<p>Note, the&nbsp;<code>index.txt<\/code>&nbsp;file must initially be completely empty with no white space.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Generate CA\/Root Private Key<\/h3>\n\n\n\n<p>In order to sign your certificates as your local CA, you will need to generate the CA private key. This can be generated using the command below;<\/p>\n\n\n\n<p>Then, generate and protect the CA root private key and store them in the above directory;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl genrsa -aes256 -out \/etc\/ssl\/kifarunixCA\/private\/cakey.pem 4096<\/code><\/pre>\n\n\n\n<p>You will be prompted to enter and confirm your passphrase.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Enter PEM pass phrase: <strong>PASSPHRASE<\/strong>\nVerifying - Enter PEM pass phrase: <strong>RE-ENTER PASSPHRASE<\/strong><\/code><\/pre>\n\n\n\n<p>You will need to keep this passphrase secured. If it falls on wrong hands, malicious actors may compromise your PKI infrastructure and issue bogus certificates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Generate CA\/Root Certificate<\/h3>\n\n\n\n<p>Next, you need to generate your self-signed X.509 CA\/Root certificate using the Root private key generated above;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl req -new -x509 -sha256 \\\n-config \/etc\/ssl\/kifarunixCA\/openssl.cnf \\\n-key \/etc\/ssl\/kifarunixCA\/private\/cakey.pem \\\n-out \/etc\/ssl\/kifarunixCA\/cacert.pem \\\n-subj \"\/C=US\/ST=California\/L=San Francisco\/O=Kifarunix, Inc.\/CN=Kifarunix Inc CA\"<\/code><\/pre>\n\n\n\n<p>You will be prompted to enter the Root private key passphrase. We also provided other CA certificate issuer information using the <code>-subj<\/code> option.<\/p>\n\n\n\n<p>You can review your CA certificate using the command below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl x509 -in \/etc\/ssl\/kifarunixCA\/cacert.pem -text<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Generate your Local SSL\/TLS Certificate Signing Request (CSR)<\/h3>\n\n\n\n<p>You can now generate your local SSL\/TLS certificates and sign them using your local CA.<\/p>\n\n\n\n<p>Thus, generate the certificate private key and the Certificate signing request (CSR);<\/p>\n\n\n\n<p>Generate the key for our domain, kifarunix.com;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl genrsa -out \/etc\/ssl\/kifarunixCA\/private\/kifarunix.com.key 4096<\/code><\/pre>\n\n\n\n<p>You are prompted for a pass-phrase for the key. Provide is and press ENTER to proceed.<\/p>\n\n\n\n<p>Next, generate the CSR;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl req -new -key \/etc\/ssl\/kifarunixCA\/private\/kifarunix.com.key \\\n-out \/etc\/ssl\/kifarunixCA\/csr\/kifarunix.com.csr \\\n-config \/etc\/ssl\/kifarunixCA\/openssl.cnf<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>Enter pass phrase for \/etc\/ssl\/kifarunixCA\/private\/kifarunix.com.key:\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [US]:\nState or Province Name (full name) [California]:\nLocality Name (eg, city) [San Francisco]:\nOrganization Name (eg, company) [Kifarunix, Inc.]:\nOrganizational Unit Name (eg, section) [IT Department]:\nCommon Name (e.g. server FQDN or YOUR name) []:*.kifarunix.com\nEmail Address []:\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\n\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Sign Certificate Requests Using Your CA and Generate TLS Certificates<\/h3>\n\n\n\n<p>Next, sign the CSR with your local CA and generate the certificate;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl ca -config \/etc\/ssl\/kifarunixCA\/openssl.cnf \\\n -in \/etc\/ssl\/kifarunixCA\/csr\/kifarunix.com.csr \\\n-out \/etc\/ssl\/kifarunixCA\/certs\/kifarunix-com.crt<\/code><\/pre>\n\n\n\n<p>When prompted, enter the root CA private key passphrase.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>Enter pass phrase for \/etc\/ssl\/kifarunixCA\/private\/cakey.pem:\nCheck that the request matches the signature\nSignature ok\nCertificate Details:\n        Serial Number: 1 (0x1)\n        Validity\n            Not Before: Feb 26 06:07:33 2023 GMT\n            Not After : Feb 23 06:07:33 2033 GMT\n        Subject:\n            countryName               = US\n            stateOrProvinceName       = California\n            organizationName          = Kifarunix, Inc.\n            organizationalUnitName    = IT Department\n            commonName                = *.kifarunix.com\n        X509v3 extensions:\n            X509v3 Basic Constraints: \n                CA:FALSE\n            X509v3 Subject Key Identifier: \n                8E:F0:E8:AF:E5:AD:76:3E:C3:58:1D:DC:22:27:85:DC:33:7B:F6:D7\n            X509v3 Authority Key Identifier: \n                FD:C0:7C:4C:20:E7:32:0A:3B:F2:E4:96:89:28:A2:48:02:95:75:7E\nCertificate is to be certified until Feb 23 06:07:33 2033 GMT (3650 days)\nSign the certificate? [y\/n]:y\n\n\n1 out of 1 certificate requests certified, commit? [y\/n]y\nWrite out database with 1 new entries\nData Base Updated\n<\/code><\/pre>\n\n\n\n<p>You now have the SSL\/TLS certificate and key (<code><strong>kifarunix.com.crt, kifarunix.com.key<\/strong><\/code>) that you can use configure your applications for secure communication.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure Web Server to Use your Local SSL\/TLS Certificates<\/h3>\n\n\n\n<p>To demonstrate this, let&#8217;s install a basic apache web server on a test node and configure it to use SSL\/TLS;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install apache2 -y<\/code><\/pre>\n\n\n\n<p>Copy the SSL\/TLS certificates to your test node;<\/p>\n\n\n\n<p>Create a simple web page;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim \/etc\/apache2\/sites-available\/demo.kifarunix.com.conf<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>&lt;IfModule mod_ssl.c&gt;\n        &lt;VirtualHost _default_:443&gt;\n                ServerName demo.kifarunix.com\n                ServerAdmin webmaster@kifarunix.com\n                DocumentRoot \/var\/www\/html\n                ErrorLog ${APACHE_LOG_DIR}\/error.log\n                CustomLog ${APACHE_LOG_DIR}\/access.log combined\n                SSLEngine on\n<strong>                SSLCertificateFile      \/etc\/ssl\/kifarunixCA\/certs\/kifarunix-com.crt\n                SSLCertificateKeyFile \/etc\/ssl\/kifarunixCA\/private\/kifarunix.com.key<\/strong>\n                &lt;FilesMatch \"\\.(cgi|shtml|phtml|php)$\"&gt;\n                                SSLOptions +StdEnvVars\n                &lt;\/FilesMatch&gt;\n                &lt;Directory \/usr\/lib\/cgi-bin&gt;\n                                SSLOptions +StdEnvVars\n                &lt;\/Directory&gt;\n        &lt;\/VirtualHost&gt;\n&lt;\/IfModule&gt;\n<\/code><\/pre>\n\n\n\n<p>Enable the site and disable default;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>a2dissite 000-default.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>a2ensite demo.kifarunix.com.conf<\/code><\/pre>\n\n\n\n<p>enable SSL module;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>a2enmod ssl<\/code><\/pre>\n\n\n\n<p>Restart Apache;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart apache2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Install Root CA Certificate into your Systems<\/h3>\n\n\n\n<p>Next, copy the root CA certificate, in our case it is <strong><code>cacert.pem<\/code><\/strong> to your systems.<\/p>\n\n\n\n<p>The certificate has to be in CRT format. Hence you can save it on the remote local host as .crt.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cacert.crt<\/code><\/pre>\n\n\n\n<p>We have already copied this file in CRT format into our local systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install Local CA Root Certificate on your Systems<\/h3>\n\n\n\n<p>At this point, you are now ready to generate the SSL\/TLS certificates signed by your local CA. However, to ensure that the certificates are trusted by your systems, you need to install the CA Root certificate on them.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Install local CA Root certificate on Ubuntu\/Debian Systems;<\/h4>\n\n\n\n<p>In Unix-based systems, <code>\/usr\/local\/share\/ca-certificates<\/code> directory is used to store additional CA (Certificate Authority) certificates that are trusted by the system. Any custom CA certificate, you can them here.<\/p>\n\n\n\n<p>To install local CA root certificate on Ubuntu\/Debian systems;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install -y ca-certificates<\/code><\/pre>\n\n\n\n<p>Copy your root CA certificate file into the <code>\/usr\/local\/share\/ca-certificates<\/code> directory;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp ~\/cacert.crt \/usr\/local\/share\/ca-certificates\/<\/code><\/pre>\n\n\n\n<p>Once you have copied, you need to update the certificate store.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo update-ca-certificates<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Updating certificates in \/etc\/ssl\/certs...\nrehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL\n1 added, 0 removed; done.\nRunning hooks in \/etc\/ca-certificates\/update.d...\ndone.<\/code><\/pre>\n\n\n\n<p>On Firefox on Ubuntu, you have to import the certificate manually into the Mozilla Trust store;<\/p>\n\n\n\n<p>Navigate to Settings &gt; Privacy &amp; Security &gt; View Certificates &gt; <strong>Import<\/strong>.<\/p>\n\n\n\n<p>Search for the CA certificate on the directory you place and import it and use enable it to <strong>Trust this CA to identify websites<\/strong>.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/firefox-import-ca-into-browser-trust-store.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1259\" height=\"748\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/firefox-import-ca-into-browser-trust-store.png\" alt=\"How to Setup a Local CA Server on Ubuntu\" class=\"wp-image-15530\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/firefox-import-ca-into-browser-trust-store.png?v=1677438311 1259w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/firefox-import-ca-into-browser-trust-store-768x456.png?v=1677438311 768w\" sizes=\"(max-width: 1259px) 100vw, 1259px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Click <strong>Ok<\/strong> to import the CA cert.<\/p>\n\n\n\n<p>Restart Browser.<\/p>\n\n\n\n<p>On Chrome, you also need to import the CA certificate. Thus on Chrome URL space space, enter, <strong><code>chrome:\/\/settings\/certificates<\/code><\/strong>;<\/p>\n\n\n\n<p>Click <strong>Authorities<\/strong> &gt; <strong>Import<\/strong> &gt; search for your CA certificate and import it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1338\" height=\"690\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-cert-on-chrome.png\" alt=\"\" class=\"wp-image-15540\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-cert-on-chrome.png?v=1677439709 1338w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-cert-on-chrome-768x396.png?v=1677439709 768w\" sizes=\"(max-width: 1338px) 100vw, 1338px\" \/><\/figure>\n\n\n\n<p>Click Ok to import.<\/p>\n\n\n\n<p>Restart Chrome browser there after.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Install local CA Root certificate on RHEL Based Systems;<\/h4>\n\n\n\n<p>Install ca-certificartes package which contains the set of CA certificates chosen by the Mozilla Foundation for use with the Internet PKI.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install ca-certificates<\/code><\/pre>\n\n\n\n<p>Install custom CA Root certificate on RHEL systems by copying your CA certificate file into <strong><code>\/etc\/pki\/ca-trust\/source\/anchors\/<\/code><\/strong> store.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp cacert.crt \/etc\/pki\/ca-trust\/source\/anchors\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo update-ca-trust<\/code><\/pre>\n\n\n\n<p>Tried Firefox browser and it seems to use the system wide trust store on Oracle Linux. Must be same for other RHEL based systems.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-local-CA-Oracle-Linux-Firefox.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1281\" height=\"775\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-local-CA-Oracle-Linux-Firefox.png\" alt=\"How to Setup a Local CA Server on Ubuntu\" class=\"wp-image-15531\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-local-CA-Oracle-Linux-Firefox.png?v=1677438553 1281w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-local-CA-Oracle-Linux-Firefox-768x465.png?v=1677438553 768w\" sizes=\"(max-width: 1281px) 100vw, 1281px\" \/><\/figure><\/a><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Install local CA Root certificate on Windows Systems;<\/h4>\n\n\n\n<p>You can install a root CA (Certificate Authority) certificate in Windows by just right clicking the certificate (CRT format) and click <strong>Install Certificate;<\/strong><\/p>\n\n\n\n<p>This opens up import wizard;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Store Location: <strong>Local Machine<\/strong><\/li>\n<\/ul>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-certificate-windows.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1184\" height=\"678\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-certificate-windows.png\" alt=\"How to Setup a Local CA Server on Ubuntu\" class=\"wp-image-15533\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-certificate-windows.png?v=1677439220 1184w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/import-ca-certificate-windows-768x440.png?v=1677439220 768w\" sizes=\"(max-width: 1184px) 100vw, 1184px\" \/><\/figure><\/a><\/div>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click Next, select <strong>Place all certificates in the following store<\/strong> and choose <strong>Trusted Root Certification Authorities<\/strong>.<\/li>\n<\/ul>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-authorities-certs.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1159\" height=\"667\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-authorities-certs.png\" alt=\"How to Setup a Local CA Server on Ubuntu\" class=\"wp-image-15534\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-authorities-certs.png?v=1677439252 1159w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-authorities-certs-768x442.png?v=1677439252 768w\" sizes=\"(max-width: 1159px) 100vw, 1159px\" \/><\/figure><\/a><\/div>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click Next to finish importation of the CA cert.<\/li>\n<\/ul>\n\n\n\n<p>Access your HTTPS site and confirm that your system can trust the SSL\/TLS certs used;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-cert-windows.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1637\" height=\"791\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-cert-windows.png\" alt=\"How to Setup a Local CA Server on Ubuntu\" class=\"wp-image-15535\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-cert-windows.png?v=1677439315 1637w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-cert-windows-768x371.png?v=1677439315 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/trusted-cert-windows-1536x742.png?v=1677439315 1536w\" sizes=\"(max-width: 1637px) 100vw, 1637px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And that is it on how to configure a Local CA Server on Ubuntu.<\/p>\n\n\n\n<p>You can now generate your local certificates that can be trusted by your local systems for development purposes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/create-locally-trusted-ssl-certificates-with-mkcert-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Create Locally Trusted SSL Certificates with mkcert on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/check-ssl-certificate-expiry-date-from-certificate-file\/\" target=\"_blank\" rel=\"noreferrer noopener\">Check SSL Certificate Expiry Date from Certificate File<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How do I set up a local certificate authority server on Linux? Well, in this tutorial you will learn how to setup a Local CA<\/p>\n","protected":false},"author":10,"featured_media":15542,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,121,1187],"tags":[6380,6381,6377,6378,6379],"class_list":["post-15515","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-howtos","category-ssl-tls","tag-configure-ca-server","tag-how-to-create-a-ca-server","tag-how-to-setup-a-local-ca-server-on-ubuntu","tag-install-local-ca-ubuntu","tag-linux-setup-local-ca-server","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15515"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=15515"}],"version-history":[{"count":15,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15515\/revisions"}],"predecessor-version":[{"id":20696,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15515\/revisions\/20696"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/15542"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=15515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=15515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=15515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}