# 查看 ca-certificates 包信息
dpkg -l ca-certificates
apt show ca-certificates

# 包含的脚本
dpkg -L ca-certificates | grep -E "bin|sbin|script"
# /usr/sbin/update-ca-certificates

# 更新证书存储（添加/删除后必须执行）
sudo update-ca-certificates

# 详细模式
sudo update-ca-certificates --fresh

# 查看当前信任的证书数量
ls /etc/ssl/certs/*.pem | wc -l

# 添加自定义 CA
sudo cp my-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
# 输出: 1 added, 0 removed; done.

# 删除自定义 CA
sudo rm /usr/local/share/ca-certificates/my-ca.crt
sudo update-ca-certificates
# 输出: 0 added, 1 removed; done.

# 禁用某个 CA（blacklist）
sudo vim /etc/ca-certificates.conf
# 将对应行改为 ! 前缀：
# !mozilla/DigiCert_Global_Root_CA.crt
sudo update-ca-certificates

# 更新证书存储
sudo update-ca-trust

# 提取模式
sudo update-ca-trust extract

# 查看当前信任的证书
trust list | head -30

# 添加自定义 CA
sudo cp my-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract

# 黑名单 CA
sudo cp untrusted-ca.crt /etc/pki/ca-trust/source/blacklist/
sudo update-ca-trust extract

# 使用 trust 工具管理
sudo trust anchor --store my-ca.crt     # 添加
sudo trust anchor --remove my-ca.crt    # 删除

# RHEL 9 使用 p11-kit 作为后端
# 查看信任策略
trust list --filter=ca-anchors | grep "DigiCert"

# 设置证书信任级别
sudo trust anchor --store --label "My CA" my-ca.crt

# Alpine 使用 ca-certificates 包 + update-ca-certificates
apk add ca-certificates

# 证书目录
ls /etc/ssl/certs/

# 添加自定义 CA
cp my-ca.crt /usr/local/share/ca-certificates/
update-ca-certificates

# Alpine 的证书包基于 Mozilla 的证书列表
apk info ca-certificates

# Arch 使用 ca-certificates 基于 p11-kit
pacman -S ca-certificates

# 管理工具
trust list                    # 查看信任的 CA
sudo trust anchor my-ca.crt   # 添加
sudo trust anchor --remove my-ca.crt  # 删除

# 证书路径
ls /etc/ssl/certs/

# 查看 OpenSSL 的默认证书路径
openssl version -d
# OPENSSLDIR: "/usr/lib/ssl"

# 查看完整的编译配置
openssl version -a | grep -E "OPENSSLDIR|ENGINESDIR"

# 证书搜索路径
ls "$(openssl version -d | cut -d'"' -f2)/certs/"
ls "$(openssl version -d | cut -d'"' -f2)/cert.pem"

# 覆盖默认证书文件
export SSL_CERT_FILE=/path/to/custom-ca-bundle.crt
openssl s_client -connect example.com:443 </dev/null

# 覆盖默认证书目录
export SSL_CERT_DIR=/path/to/custom-certs/
openssl s_client -connect example.com:443 </dev/null

# 同时设置（推荐）
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_DIR=/etc/ssl/certs/

# 查看默认配置文件位置
openssl version -d
# 编辑 openssl.cnf
cat /etc/ssl/openssl.cnf | grep -A5 "CA_default"

# 可以在配置文件中指定 CA 路径
# [ ca ]
# default_ca = CA_default
#
# [ CA_default ]
# dir = /etc/ssl/my-ca
# certs = $dir/certs
# crl_dir = $dir/crl
# database = $dir/index.txt

# 方法 1：直接复制证书文件
FROM ubuntu:22.04
COPY my-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates

# 方法 2：使用构建参数
FROM ubuntu:22.04
ARG CA_CERT
RUN echo "$CA_CERT" > /usr/local/share/ca-certificates/custom-ca.crt && \
    update-ca-certificates

# Alpine
FROM alpine:3.18
COPY my-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates

# 构建时传入证书
docker build --build-arg CA_CERT="$(cat my-ca.crt)" -t myapp .

# 运行时挂载证书
docker run -v /path/to/my-ca.crt:/usr/local/share/ca-certificates/my-ca.crt:ro \
  myapp sh -c "update-ca-certificates && my-command"

# 将自定义 CA 作为 ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: custom-ca
data:
  my-ca.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDxxxxxxx...
    -----END CERTIFICATE-----
---
# 挂载到 Pod
apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: ca-volume
      mountPath: /usr/local/share/ca-certificates/
      readOnly: true
  volumes:
  - name: ca-volume
    configMap:
      name: custom-ca

# ca-certificates 包通过 apt 更新
sudo apt update && sudo apt install ca-certificates

# 查看最近更新
apt changelog ca-certificates | head -30

# 自动安全更新（unattended-upgrades）
cat /etc/apt/apt.conf.d/50unattended-upgrades | grep ca-certificates

# 通过 yum/dnf 更新
sudo dnf update ca-certificates

# 查看包信息
rpm -qi ca-certificates

# 自动更新（yum-cron / dnf-automatic）
sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

# 错误 1: "certificate verify failed"
curl: (60) SSL certificate problem: unable to get local issuer certificate

# 诊断步骤
# 1. 检查系统证书存储是否完整
ls /etc/ssl/certs/ca-certificates.crt
ls -la /etc/ssl/certs/ | head -5

# 2. 检查 update-ca-certificates 是否正常
sudo update-ca-certificates --fresh

# 3. 检查 OpenSSL 的证书路径
openssl version -d
openssl s_client -connect example.com:443 -CApath "$(openssl version -d | cut -d'\"' -f2)/certs" </dev/null

# 4. 检查环境变量
echo $SSL_CERT_FILE
echo $SSL_CERT_DIR

# 错误 2: 自定义 CA 添加后仍不被信任
# 原因：某些应用使用自己的证书存储（如 Python requests）

# 解决方案
# Python
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
# 或
pip install --upgrade certifi
python -c "import certifi; print(certifi.where())"

# Java
keytool -import -trustcacerts \
  -keystore $JAVA_HOME/lib/security/cacerts \
  -storepass changeit \
  -alias my-ca -file my-ca.crt

# Node.js
export NODE_EXTRA_CA_CERTS=/path/to/my-ca.crt