https://lead-devops.blackdevhub.online/en/tags/pki/Recent content in Pki on Lead DevOpsHugoenMon, 31 Aug 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/trust-custom-ca/Mon, 31 Aug 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/trust-custom-ca/<p>A TLS error that says the certificate is untrusted almost never means the certificate is “broken”. The <strong>trust anchor</strong> is in the wrong store.</p> <p><code>curl</code>, <code>openssl</code>, Git, Python, and the browser are different clients. Some keep their own root lists. Updating the OS bundle on Linux will not fix Chrome or Firefox by itself.</p> <h2 id="what-to-import">What to import</h2> <p>You trust the <strong>CA root</strong> that signed the server certificate, not <code>localhost.crt</code> / <code>app.example.internal</code> itself.</p>