From: Lloyd Subject: Re: /etc/ssl/cert.pem : concatenate system and local files To: Sebastien Marie Cc: tech@openbsd.org Date: Fri, 22 May 2026 19:31:01 +0000 I like this idea but I think the diff is broken. Initial comments: 1. mktemp fails - shouldn't it be -p not -t? 2. the generated cert.pem has permissions 0600 root:wheel in my testing, it needs to be world-readable, should it be 0444 root:bin? 3. I would think cert.local.pem should have 0644 perms 4. With this tucked away into /etc/rc, what is the official update procedure to regenerate cert.pem when adding a certificate? 5. where in the man pages do we note the existence of cert.local.pem? Regards Lloyd Sebastien Marie wrote: > Hi, > > Following previous discussion on misc@ about how to add private trusted > certificate authorities on OpenBSD, I tried to look at it. > > The following diff does: > - installing the trusted cert.pem (from lib/libcrypto) as cert.base.pem > - in rc(8), generate cert.pem from cert.base.pem (the system one) and > cert.local.pem (the local file) > > The rest is about using cert.base.pem for installer or for rc (checking > libssl.so relinking). > > misc@ discussion : https://marc.info/?l=openbsd-misc&m=177808544804485&w=2 > > Comments ? > -- > Sebastien Marie > > > diff --git a/distrib/amd64/ramdisk_cd/list b/distrib/amd64/ramdisk_cd/list > index 2daf2d018e..88e2461bef 100644 > --- a/distrib/amd64/ramdisk_cd/list > +++ b/distrib/amd64/ramdisk_cd/list > @@ -69,7 +69,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/arm64/ramdisk/list b/distrib/arm64/ramdisk/list > index 3a8ae2e6dd..e820b3d4f7 100644 > --- a/distrib/arm64/ramdisk/list > +++ b/distrib/arm64/ramdisk/list > @@ -70,7 +70,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/armv7/ramdisk/list b/distrib/armv7/ramdisk/list > index a0f50dd607..b0745aa85a 100644 > --- a/distrib/armv7/ramdisk/list > +++ b/distrib/armv7/ramdisk/list > @@ -69,7 +69,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/hppa/ramdisk/list b/distrib/hppa/ramdisk/list > index f6a78a103f..db2e4c4227 100644 > --- a/distrib/hppa/ramdisk/list > +++ b/distrib/hppa/ramdisk/list > @@ -61,7 +61,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/i386/ramdisk_cd/list b/distrib/i386/ramdisk_cd/list > index d582b5bdff..1feed9ae90 100644 > --- a/distrib/i386/ramdisk_cd/list > +++ b/distrib/i386/ramdisk_cd/list > @@ -66,7 +66,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/macppc/ramdisk/list b/distrib/macppc/ramdisk/list > index 62d9d91dd6..63425b9021 100644 > --- a/distrib/macppc/ramdisk/list > +++ b/distrib/macppc/ramdisk/list > @@ -67,7 +67,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/miniroot/install.sub b/distrib/miniroot/install.sub > index 983881cfb3..a5f25ced10 100644 > --- a/distrib/miniroot/install.sub > +++ b/distrib/miniroot/install.sub > @@ -3662,7 +3662,8 @@ > [[ $1 == -!(stable) ]] && HTTP_SETDIR=snapshots/$ARCH > > # Detect if ftp(1) has tls support and set defaults based on that. > -if [[ -e /etc/ssl/cert.pem ]]; then > +if [[ -e /etc/ssl/cert.base.pem ]]; then > + ln -f /etc/ssl/cert.base.pem /etc/ssl/cert.pem > FTP_TLS=true > HTTP_PROTO=https > else > diff --git a/distrib/octeon/ramdisk/list b/distrib/octeon/ramdisk/list > index 10638a6d6f..9260ec11c7 100644 > --- a/distrib/octeon/ramdisk/list > +++ b/distrib/octeon/ramdisk/list > @@ -65,7 +65,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/powerpc64/ramdisk/list b/distrib/powerpc64/ramdisk/list > index 8ae92b67a4..0291e02071 100644 > --- a/distrib/powerpc64/ramdisk/list > +++ b/distrib/powerpc64/ramdisk/list > @@ -68,7 +68,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/riscv64/ramdisk/list b/distrib/riscv64/ramdisk/list > index d04c6addcd..832d58174d 100644 > --- a/distrib/riscv64/ramdisk/list > +++ b/distrib/riscv64/ramdisk/list > @@ -67,7 +67,7 @@ > ARGVLINK ksh -sh > SPECIAL rm bin/md5 > > -SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.pem etc/ssl/cert.pem > +SPECIAL awk -f ${UTILS}/trimcerts.awk ${DESTDIR}/etc/ssl/cert.base.pem etc/ssl/cert.base.pem > LINK instbin usr/bin/ftp-ssl usr/bin/ftp > SPECIAL rm usr/bin/ftp-ssl > > diff --git a/distrib/sets/lists/etc/mi b/distrib/sets/lists/etc/mi > index 2be6c70eb6..57a64e025c 100644 > --- a/distrib/sets/lists/etc/mi > +++ b/distrib/sets/lists/etc/mi > @@ -37,7 +37,7 @@ > ./etc/spwd.db > ./etc/ssh/ssh_config > ./etc/ssh/sshd_config > -./etc/ssl/cert.pem > +./etc/ssl/cert.base.pem > ./etc/ssl/ikeca.cnf > ./etc/ssl/openssl.cnf > ./etc/ssl/x509v3.cnf > diff --git a/etc/changelist b/etc/changelist > index 0dc0188b18..6da8ad922e 100644 > --- a/etc/changelist > +++ b/etc/changelist > @@ -148,7 +148,8 @@ > +/etc/ssh/ssh_host_rsa_key > /etc/ssh/ssh_host_rsa_key.pub > /etc/ssh/sshd_config > -/etc/ssl/cert.pem > +/etc/ssl/cert.base.pem > +/etc/ssl/cert.local.pem > /etc/suid_profile > /etc/sysctl.conf > /etc/syslog.conf > diff --git a/etc/rc b/etc/rc > index 53ceedd713..fa1b560aa2 100644 > --- a/etc/rc > +++ b/etc/rc > @@ -227,7 +227,7 @@ > [[ -s $_lib ]] && file $_lib | fgrep -q 'shared object' > LD_BIND_NOW=1 LD_LIBRARY_PATH=$_tmpdir awk 'BEGIN {exit 0}' > LD_BIND_NOW=1 LD_LIBRARY_PATH=$_tmpdir openssl \ > - x509 -in /etc/ssl/cert.pem -out /dev/null > + x509 -in /etc/ssl/cert.base.pem -out /dev/null > $_install $_lib $_lib_dir/$_lib > fi > ) || { _error=true; break; } > @@ -348,6 +348,33 @@ > esac > } > > +# Regenerate /etc/ssl/cert.pem from base and local files. > +regen_ssl_cert_pem() { > + cert_tmp=$(mktemp -t /etc/ssl cert.pem.XXXXXXXX) && { > + > + # always use cert.base.pem as base file > + cat /etc/ssl/cert.base.pem >${cert_tmp} > + > + # append cert.local.pem to cert.pem if exists > + [ -r /etc/ssl/cert.local.pem ] && \ > + cat /etc/ssl/cert.local.pem >>${cert_tmp} > + > + # check the resulting file is valid > + if openssl x509 -in ${cert_tmp} -out /dev/null ; then > + # pivot to cert.pem file > + mv -f ${cert_tmp} /etc/ssl/cert.pem > + else > + rm -f ${cert_tmp} > + fi > + } > + > + # ensure we have a cert.pem file > + if [ ! -e /etc/ssl/cert.pem ] ; then > + echo "error: fallback to default cert.pem" >&2 > + ln -f /etc/ssl/cert.base.pem /etc/ssl/cert.pem > + fi > +} > + > # End subroutines. > > stty status '^T' > @@ -503,6 +530,8 @@ > mount -s /var/log >/dev/null 2>&1 # cannot be on NFS > mount -s /usr >/dev/null 2>&1 # if NFS, fstab must use IP address > > +regen_ssl_cert_pem > + > reorder_libs 2>&1 |& > > start_daemon slaacd dhcpleased resolvd >/dev/null 2>&1 > diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile > index 92866400c2..cbac0b8090 100644 > --- a/lib/libcrypto/Makefile > +++ b/lib/libcrypto/Makefile > @@ -748,7 +748,7 @@ > ${INSTALL} ${INSTALL_COPY} -o ${BINOWN} -g ${BINGRP} -m 444 \ > ${.CURDIR}/openssl.cnf ${DESTDIR}/etc/ssl/openssl.cnf && \ > ${INSTALL} ${INSTALL_COPY} -o ${BINOWN} -g ${BINGRP} -m 444 \ > - ${.CURDIR}/cert.pem ${DESTDIR}/etc/ssl/cert.pem && \ > + ${.CURDIR}/cert.pem ${DESTDIR}/etc/ssl/cert.base.pem && \ > ${INSTALL} ${INSTALL_COPY} -o ${BINOWN} -g ${BINGRP} -m 444 \ > ${.CURDIR}/x509v3.cnf ${DESTDIR}/etc/ssl/x509v3.cnf > > >