update-ca-trust extract not adding certificates to ca-bundle

In my case it was just because i was not using sudo

Copy the CA certificate to /etc/pki/ca-trust/source/anchors, then call below command

sudo update-ca-trust extract

After this check the exit code, should be 0

echo $?

OR grep CA certificate name in below file for confirmation

cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep "CA-cert-name"

1.get ca cert's issue

openssl x509 -in ca.crt -noout -text |grep -i "issue"

output like below:

Issuer: CN=something_strings

2.find issue in /etc/pki/tls/certs/ca-bundle.crt

grep -i "something_strings" /etc/pki/tls/certs/ca-bundle.crt

output like below:

something_strings

if you can get result, then your certs is added with success.

you need to reboot server for take affect.

TL;DR

The update-ca-trust won't extract your certificate file to the ca-bundle.crt unless this succeeds:

openssl x509 -noout -text -in <cert_file> | grep --after-context=2 "X509v3 Basic Constraints" | grep "CA:TRUE"

---

I spent a few hours on this issue. Its root was in a X.509 extension called Basic Constraints which is used to mark whether a certificate belongs to a CA or not.

My humble findings:

1. The update-ca-bundle tool is in fact a shell script, so it's easy to peek inside
2. The script calls p11-kit utility multiple times each time using different filter and creating different bundle files.
3. The file ca-bundle.crt is in fact a link from tls-ca-bundle.pem file which is generated by p11-kit using ca-anchors filter. So it ignores all certs besides "CA ones".
4. If a certificate is or is not a CA is decided by Basic Constraints X.509 extension. This way it's possible to mark a certificate as a part of a CA.
5. It's possible to list all X.509 extensions using openssl x509 -noout -text -in <cert_file>
6. So any certificate file not labelled as a part of a CA will be filtered out by p11-kit and not exported to the desired ca-bundle.crt file.

Feel free to correct this in comments.

I don't know exactly what you are asking but the steps below work for me. I enable 'ca trust', copy over the file, extract, and then verify.

$ update-ca-trust enable
$ cp ZScalar.pem /etc/pki/ca-trust/source/anchors/
cp: overwrite ‘/etc/pki/ca-trust/source/anchors/ZScalar.pem’? yes
$ update-ca-trust extract
$ openssl verify  ZScalar.crt
ZScalar.crt: OK

If these steps don't work please post the output of the "openssl verify" command and I might be able to direct you further.

To add to this, extracted certs go to "/etc/pki/ca-trust/extracted/openssl" or "/etc/pki/ca-trust/extracted/pem".