Add permanent SSL certificate exception in Chrome (Linux)

Question

I have a problem with a website that has an SSL certificate which doesn't correspond to the website domain. Chrome gives me a warning for this website (and rightly so), which I have to ignore manually. Every time I restart Chrome, I need to ignore the certificate issue again.

I've tried adding the certificate as a trusted one with certutil, using C,, and P,, trustargs, but it doesn't work. I can't find a set of trustargs that will tell it to ignore which domain is using the certificate.

Is there a way to tell Chrome (or certutil) to trust this certificate whatever domain uses it?

score 63 · Accepted Answer · edited Mar 20 '17 at 10:17

63

This is a summary of the answers from the thread
Disable Google Chrome warning if security certificate is not trusted.

You can avoid the message for trusted sites by installing the certificate.
This can be done by clicking on the warning icon in the address bar, then click
Certificate Information -> Details Tab -> Export...
Save the certificate.

Use Chrome's Preferences -> Under The Hood -> Manage Certificates -> Import.
On the "Certificate Store" screen of the import, choose "Place all certificates in the following store" and browse for "Trusted Root Certification Authorities." Restart Chrome.

edited Mar 20 '17 at 10:17

Community

1

answered Feb 11 '10 at 09:27

harrymc

480,290

10

Thank you, but this only works on Windows. On Linux, Chrome uses the certutil command line tool to manage certificates, nothing else. – raphink Feb 11 '10 at 11:30
1

It seems I can't select your answer as the right one anymore because the bounty expired :'( – raphink Feb 15 '10 at 09:24
@Raphink: Does this work after all in Linux? – harrymc Feb 15 '10 at 09:28
3

No, it doesn't work on Linux, and the bounty cannot be relaunched. – raphink Feb 22 '10 at 09:43
1

FYI, this (now?) does work on Chromium 18, Ubuntu 12.04 - same instructions found here: http://superuser.com/a/41937/55046 – Zayne S Halsall Jan 15 '13 at 05:08
Good answer, thank you. I just wish it was easier, 1 click ideally :-) – Josef Sábl Sep 05 '14 at 08:07
3
2 quick things to add to this:
1. It seems to work best if you go to the "Authorities" tab in the certificate manager, before clicking "Import..." (thus adding you, or whoever signed the certificate, as a trusted signer-of-certificates)
2. I'm not sure if I needed to, but I checked all the checkboxes under "Edit trust settings".
– Sean the Bean Oct 10 '14 at 17:30
Worked like a charm, never considered it thank you! – Rudi Strydom Dec 12 '14 at 15:20
There is no certificate information any more in recent chrome versions. – user1050755 Apr 21 '17 at 08:30
@user1050755: What do you mean? AFAIK certificates are reachable via Settings > Show advanced settings > HTTPS/SSL > Manage certificates. – harrymc Apr 21 '17 at 09:00
@user1050755 Dev Tools (F12) > Security tab > View Certificate – Andre Figueiredo Jun 05 '17 at 20:20

Tundrome · Answer 2 · 2013-05-22T13:55:22.517

16

Using Chrome Version 23.0.1271.97 on Linux:

First click on the certificate warning and export the certificate to your file system. (Connection > Certificate Information > Details > Export)

Then use certutil in order to add this saved certificate as a trusted peer:

certutil -d sql:$HOME/.pki/nssdb -A -t P -n <certificate nickname> -i <certificate filename>

Restart Chrome and you're done.

edited May 22 '13 at 13:55

answered May 22 '13 at 13:45

Tundrome

161

2

This worked for me, thanks! I had to run this first (opensuse linux): sudo zypper install mozilla-nss-tools – gatoatigrado Sep 27 '13 at 08:09
This is a great answer, if you want to understand better how it works, use certutil -H -A, and maybe read about trust flags in NSS Database: https://blogs.oracle.com/meena/entry/notes_about_trust_flags – Tomasz Gandor Nov 25 '15 at 08:24
to install certutil i used sudo apt-get install libnss3-tools – shatulsky Jul 20 '23 at 14:15

score 12 · Answer 3 · answered Apr 22 '13 at 12:41

12

The only way I got it working in Chromium with Ubuntu Linux is using this certutil commandline:

certutil -d sql:$HOME/.pki/nssdb -A -t "CP,CP," -n CertNickName -i cert_file.crt

answered Apr 22 '13 at 12:41

Treviño

517

2

This worked for me using Arch too. – Tim Jul 23 '15 at 08:48
That worked for me on Centos 7 – The_Cute_Hedgehog Sep 26 '16 at 13:26
3

Worked Debian 9 also (requires libnss3-tools package installed first). – nd34567s32e Nov 02 '17 at 13:47
Worked for me on Debian 11 – David Alsh Mar 10 '23 at 02:11
Works in Ubuntu 22.04, Chrome 120... – Md. A. Apu Jan 03 '24 at 12:21

score 4 · Answer 4 · answered Feb 11 '10 at 15:58

4

Please have a look at this thread:
Can't convince Chrome that my Tivo's self signed certificate is ok.

The article remarks that:

You need to specify the "C,," trust flags to work around the NSS bug.

If this thread does relate to your problem, it looks like this is a known bug in Chrome, where the "P,," trust flags is not working: libpkix ignores the P (trusted peer) trust flag

I hope this helps (I'm answering a bit blindly, since I'm not on Linux).

answered Feb 11 '10 at 15:58

harrymc

480,290

Thanks, it seems to be related to my problem, and hence a bug in Chrome. I'll consider your suggestion as an answer to my question, even though it doesn't really fix my problem :-) – raphink Feb 15 '10 at 09:23

score 0 · Answer 5 · edited Jul 04 '11 at 07:41

0

Google Chrome in Linux doesn’t have a SSL certificate manager, it relies on the NSS Shared DB. In order to add SSL certificates to the database you will have to use the command line. I will explain how you can add the CAcert certificates and a very easy way to add self-signed certificates.

Please have a look at this thread: blog.avirtualhome.com/2010/02/02/adding-ssl-certificates-to-google-chrome-linux-ubuntu/

edited Jul 04 '11 at 07:41

Jonathan Day

1,611

answered Feb 02 '11 at 09:49

k din

25

1

You should move the stuff from the blog post into here. Currently as it stands this is pretty much a link-only answer. – AlbertEngelB Aug 11 '15 at 20:50
-1 Need to explain here. Links die. This will live. – Elijah Lynn Feb 21 '17 at 17:23
3

aaaaand the link is dead. – Mike Diehn Jun 11 '18 at 16:56
Looks like the waybackmachine captured it :) https://web.archive.org/web/20121020174226/http://blog.avirtualhome.com/adding-ssl-certificates-to-google-chrome-linux-ubuntu/ – Nate Bosscher Jan 12 '22 at 17:12

Add permanent SSL certificate exception in Chrome (Linux)

5 Answers5

Linked