FreeBSD: install new rootCA

To install a CA certificate on FreeBSD, you need to copy the certificate to the appropriate directory, calculate its hash, and create a symbolic link using the hash. This process ensures that the system recognizes the certificate as a trusted Certificate Authority.

Here's a more detailed breakdown:

1. Copy the certificate:

Place the CA certificate file (usually a .crt or .pem file) in the /usr/local/etc/ssl/certs directory. If the directory doesn't exist, create it.

2. Calculate the hash:

Use the openssl x509 -inform PEM -subject_hash_old -in <certificate_file> command to determine the hash value of the certificate. The -subject_hash_old option ensures compatibility with older systems.

3. Create the symbolic link:

Create a symbolic link in the same directory using the calculated hash as the filename, followed by .0. The link should point to the original certificate file.

4. Rehash:

Run the certctl rehash command to update the certificate store and make the new certificate available.

Example:

Let's say your certificate file is my-ca.pem. Copy:

sudo cp my-ca.pem /usr/local/etc/ssl/certs/

Calculate hash:

hashed_name=$(openssl x509 -inform PEM -subject_hash_old -in /usr/local/etc/ssl/certs/my-ca.pem | head -1)

Create link:

sudo ln -s /usr/local/etc/ssl/certs/my-ca.pem /usr/local/etc/ssl/certs/$hashed_name.0

Rehash:

sudo certctl rehash

After these steps, your FreeBSD system should recognize and trust the new CA certificate.