Brontekst bekijken van FreeBSD: install new rootCA

To install a CA certificate on FreeBSD, you need to copy the certificate to the appropriate directory, 
calculate its hash, and create a symbolic link using the hash. This process ensures that the system recognizes the certificate as a trusted Certificate Authority. 

Here's a more detailed breakdown:

1. Copy the certificate:

Place the CA certificate file (usually a .crt or .pem file) in the /usr/local/etc/ssl/certs directory. If the directory doesn't exist, create it. 

2. Calculate the hash:

Use the openssl x509 -inform PEM -subject_hash_old -in <certificate_file> command to determine the hash value of the certificate. The -subject_hash_old option ensures compatibility with older systems. 

3. Create the symbolic link:

Create a symbolic link in the same directory using the calculated hash as the filename, followed by .0. The link should point to the original certificate file. 

4. Rehash:

Run the certctl rehash command to update the certificate store and make the new certificate available. 


Example:

Let's say your certificate file is my-ca.pem. 
Copy: 
 sudo cp my-ca.pem /usr/local/etc/ssl/certs/

Calculate hash: 
 hashed_name=$(openssl x509 -inform PEM -subject_hash_old -in /usr/local/etc/ssl/certs/my-ca.pem | head -1)

Create link: 
 sudo ln -s /usr/local/etc/ssl/certs/my-ca.pem /usr/local/etc/ssl/certs/$hashed_name.0

Rehash: 
 sudo certctl rehash

After these steps, your FreeBSD system should recognize and trust the new CA certificate.