Trust different root certificate authorities in Chromium


Sven

I'm using different profiles --user-data-dir=in Chromium under Linux . In one config file I want to trust other root certificate authority (CA) and in other config file the certificate should not be trusted. According to the documentation, Chromium is using $HOME/.pki/nssdbimport certificates. Is there any way I can use a different location for this truststore?

Alexei Pelenko

It doesn't seem possible to change this location.

However, you can set up a new location, create a new database and add certificates $HOMEto it before running Chromium . For example, $HOMEit can be set to--user-data-dir=

It's worth noting that this method starts Chromium from your original home directory and makes some configurations not available for Chromium. At least I noticed that it won't use your desktop theme and downloads will go to the newly created home directory.

To illustrate this, we can grab a script from here that runs Chromium in a temporary directory and modifies it to import the Burp CA certificate before starting Chromium:

#!/bin/bash

BASE_TEMP_DIR=/tmp
CA_CERT=/opt/burp.der
TEMP_DIR=$(mktemp -d $BASE_TEMP_DIR/google-chome.XXXXXXX)

echo "Running Chrome with temp folder in: $TEMP_DIR"
export HOME=$TEMP_DIR
NSSDB=$HOME/.pki/nssdb/
mkdir -p $NSSDB
certutil -N -d sql:${NSSDB} --empty-password
certutil -d sql:${NSSDB} -A -t "C,," -n Burp -i $CA_CERT
google-chrome --user-data-dir=$TEMP_DIR --no-first-run --disable-reading-from-canvas --proxy-server="http://localhost:8080" "$@"

rm -rf $TEMP_DIR

Related


Trust different root certificate authorities in Chromium

Sven I'm using different profiles --user-data-dir=in Chromium under Linux . In one config file I want to trust other root certificate authority (CA) and in other config file the certificate should not be trusted. According to the documentation, Chromium is usi

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Make Selenium Firefox Webdriver trust the root certificate

VBobCat I am creating a Selenium Firefox Webriver instance with the following code: Dim fxProfile As FirefoxProfile = New FirefoxProfile With fxProfile .AcceptUntrustedCertificates = True .AssumeUntrustedCertificateIssuer = False

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

Is it "safe" to permanently trust the Fiddler root certificate?

Dan Stevens I'm inspecting HTTP traffic sent and received using Fiddler's WFC client. For this, I have added the Fiddler root certificate to the Windows certificate store. My question: is it possible to keep that certificate in the Windows store for use when I

JVM/Android doesn't trust StartSSL's root certificate

Christopher I have set up a VPS hosting two websites using Apache. Both have a (valid) SSL configuration with a StartSSL certificate, and I have no problem accessing them from a desktop or mobile browser. I'm trying to access an API that one of the websites is

JVM/Android doesn't trust StartSSL's root certificate

Christopher I have set up a VPS hosting two websites using Apache. Both have a (valid) SSL configuration with a StartSSL certificate, and I have no problem accessing them from a desktop or mobile browser. I'm trying to access an API that one of the websites is

Certificate Revocation Lists and Private Certificate Authorities

username all, I have several questions related to certificate revocation lists for private certificate authorities. Currently, we have a self-signed CA that generates client certificates for accessing our application. We are looking to implement a CRL, but som