Where to Store PEM Files for SSL Certificate Validation

12.04opensslssl

I'm writing a SOAP client application on Ubuntu using OpenSSL and C++. I am having trouble getting my code to validate the server certificate even though I know has a valid certificate.

Just to make sure I would like to check that it's the case and apparently PEM files are used to list valid certificates.

Can anyone tell me where these files reside on my Ubuntu 12.04 installation? I have the ca-certificates package installed on my machine, so these files must be there somewhere?

Best Answer

So if you have installed ca-certificates you can easily find out where the files are. Open a terminal and enter

> dpkg -L ca-certificates
/.
/etc
/etc/ssl
/etc/ssl/certs
/etc/ca-certificates
/etc/ca-certificates/update.d
/usr
/usr/sbin
/usr/sbin/update-ca-certificates
/usr/share
/usr/share/ca-certificates
/usr/share/ca-certificates/spi-inc.org
…

So you'll see that all certificates are in /usr/share/ca-certificates. However the default location for certificates is /etc/ssl/certs. You might find additional certificates there.

Related Solutions

Pidgin SSL Certificates – Ubuntu Storage Location

They're stored here:

~/.purple/certificates/x509/tls_peers/

I've seen that replacing omega.contacts.msn.com's content with this fixes it for me (warning: there could be security implications for this):

UPS – Configure NUT and SSL Certificates on Ubuntu 14.04 Server

Your problem is due to the new NSS backend in nut, which was added in 2.7.1 (Changes from 2.6.5 to 2.7.1). The client tries first to contact tcp/3943 with a STARTTLS command and gets ERR FEATURE-NOT-CONFIGURED from upsd, so it shows that warning.

The rationale for this change is that you are transmitting passwords in plaintext over the wire and the developers added SSL certificate support to prevent that. The client is being noisy, after all.

The error message is actually from the client, but you cannot exclude it with a grep because it's coming from the error output (stderr).

The easiest way of solving your problem is to pipe it properly:

upsc ups@neutron.local 2>&1 | grep -v '^Init SSL'

or if you're just using some part of the output for e.g. an RRD graph and you were getting garbage in your cron output, just add the 2>&1 and it will be a normal line:

upsc ups@neutron.local 2>&1 | grep 'battery.charge:' | awk ...

The not-so-easy way of fixing this is to actually configure SSL certificates and the rest of the stuff, like described in 9. Notes on securing NUT | Configuring SSL | NSS backend usage.

Best Answer

Related Solutions

Pidgin SSL Certificates – Ubuntu Storage Location

UPS – Configure NUT and SSL Certificates on Ubuntu 14.04 Server

Related Question