Linux CA Management with update-ca-trust

In enterprise Linux environments, establishing trust for internal services, private PKI, and secure web communications requires centralized management of Certificate Authorities (CAs). Distributions such as Red Hat Enterprise Linux (RHEL), CentOS, Fedora, and Rocky Linux implement the update-ca-trust framework to manage this process. This article explains the mechanics of the shared system certificates storage, how the update-ca-trust command integrates custom certificates into the central trust store, and how various cryptographic libraries access these compiled certificates.

The Shared System Certificates Architecture

Modern Linux distributions consolidate CA certificates into a unified trust store rather than requiring each application to maintain its own bundle. This centralized system relies on a specific directory hierarchy under /etc/pki/ca-trust/ and /usr/share/pki/ca-trust-source/:

/usr/share/pki/ca-trust-source/: Contains the distribution-provided default certificates managed by package managers (such as the Mozilla CA bundle).
/etc/pki/ca-trust/source/anchors/: The local administrator directory where new, custom CA certificates (such as internal root certificates or intermediate authorities) should be placed.
/etc/pki/ca-trust/source/blacklist/: Contains certificates that must be explicitly rejected or distrusted by the operating system.
/etc/pki/ca-trust/extracted/: The output directory where update-ca-trust writes the compiled trust lists in multiple formats.

How update-ca-trust Works

The update-ca-trust tool acts as a build script. When invoked, it evaluates the trust configuration, scans the source directories, and converts the individual certificates into standardized output formats for various cryptographic engines.

1. Merging and Precedence

The tool reads the base system certificates and merges them with the local certificates stored in /etc/pki/ca-trust/source/anchors/. If a certificate is located in /etc/pki/ca-trust/source/blacklist/, update-ca-trust marks it as explicitly distrusted, overriding any system defaults.

2. Output Generation

Different software suites on Linux use different cryptographic libraries, such as OpenSSL, GnuTLS, and Java. To provide consistency across all tools, update-ca-trust extract builds multiple bundled formats within /etc/pki/ca-trust/extracted/:

pem/tls-ca-bundle.pem: Used by OpenSSL, curl, git, and most command-line utilities for standard TLS trust verification.
pem/email-ca-bundle.pem: Used for S/MIME email signing and encryption verification.
openssl/ca-bundle.trust.crt: Contains extended OpenSSL-specific trust flags.
java/cacerts: A Java Keystore file used by the Java Virtual Machine (JVM) runtime to validate TLS connections in Java applications.
edk2/cacerts.bin: Formatted for UEFI/EDK2 firmware verification.

The operating system manages symlinks from classic locations (such as /etc/ssl/certs/ca-bundle.crt or /etc/pki/tls/cert.pem) directly to these generated files, ensuring backward compatibility with legacy applications.

Managing Certificates with update-ca-trust

Managing CA certificates involves a simple three-step lifecycle:

Adding a New Certificate

To add an enterprise or self-signed Root CA to the system-wide store:

Convert the certificate to PEM or DER format (typically with a .crt extension).
Copy the file into the administrator anchors directory:
```
cp my-custom-ca.crt /etc/pki/ca-trust/source/anchors/
```
Update the compiled trust store:
```
update-ca-trust extract
```

Removing a Certificate

To revoke trust for a custom CA added previously:

Delete the certificate file from /etc/pki/ca-trust/source/anchors/.
Regenerate the system bundles:
```
update-ca-trust extract
```

Explicit Distrust

If a built-in upstream certificate needs to be disabled without removing OS-level packages:

Place the certificate into /etc/pki/ca-trust/source/blacklist/.
Run update-ca-trust extract.

Running update-ca-trust ensures that all low-level trust databases are synchronized simultaneously, eliminating the need to configure separate certificate stores for individual runtimes and tools.