I need to add a root certificate foo.crt (not its real name). It works on my Ubuntu system and the following looks valid. openssl x509 -in ./foo.crt -text -noout I am trying to add it using: > sudo trust anchor ./foo.crt p11-kit: couldn't create object: The field is read-only p11-kit: 1 error wh…

I found a way to do it but it seems odd. sudo cp my-root-ca.crt /etc/pki/ca-trust/source/anchors/ sudo update-ca-trust This results in a file in /etc/pki/ca-trust/extracted/pem/directory-hash/. As it turns out this is not where openssl looks by default which is governed by /etc/pki/tls/openssl.c…

Here are some of my guesses as to where these root certificates are obtained. This seems like a bit of a mess. Possible root cert source System-Wide Trust Store Updates (update-ca-trust tool) The update-ca-trust utility managed the system-wide CA certificates. When a root certificate is added to /…

I personally use sudo trust anchor --store /path/to/crt I also run the user p11-kit service/socket as well. Then, I make sure the flatpak browsers have access to the p11-kit socket. With these, I seemingly am able to have the credentials added to browsers and work with commandline tools like git/…

Could you provide a bit more information on the p11-kit service / socket? Meaning, how is it used in bluefin? I was not aware of it. Here are some links I found. p11-kit: p11-kit Remoting / Forwarding: p11-kit Is this what you were talking about regarding service / socket? systemctl --user ena…

systemctl enable --now --user p11-kit-server.{service,socket} You will now have a p11-kit server running for your user. The socket which can communicate with it can then be binded into flatpaks giving them access to pkcs11 tokens inside the flatpak.

I ran… systemctl --user list-unit-files | grep p11 …and see the unit files you mentioned. I also looked at… systemctl --user list-unit-files I did not realize there were user services that were disabled by default. What are they all for? Sorry, got distracted there.

This exposes a p11-kit-server that can be accessed remotely and enables you to load different modules for accessing pkcs11 tokens.

[image] m2Giles: systemctl enable --now --user p11-kit-server.{service,socket} After enabling the systemd unit, how do you allow FlatPak browsers to use them? I have used FlatSeal, but there is nothing related to p11 that I could find. When I use curl , I still get a certificate error. The c…

I’m not sure how to add an additional socket via Flatseal, but you should be able to add it via the flatpak override command from the terminal. Something like: flatpak override –socket=p11-kit-server org.mozilla.firefox

Adding Root Certificate

General

phreed November 19, 2024, 10:00pm 2

To make my question clear.

How do a add a root certificate to bluefin?
How do I validate certificates signed by that root certificate?

Topic		Replies	Views
Flatpak firefox and system certificates Bazzite	0	263	July 13, 2024
Trusting Home Server CA in Bluefin Bluefin	4	132	January 14, 2025
Installing 1Password in Bluefin, a better way? Bluefin	39	3414	September 19, 2025
Smartcard access for native Firefox Bluefin	5	265	August 11, 2025
Building a flatpak that plays well with Bluefin and family Bluefin	6	250	May 27, 2025

Adding Root Certificate

Related topics