Files

T

Raven Scott 1ffdd12efb fix(linux): install root CA in system store and NSS for Chrome

Chrome/Chromium on Linux use ~/.pki/nssdb, not only
update-ca-certificates. Auto-install now runs both paths.
- certificate_authority.js: installLinuxRootCA + certutil for
  user NSS (~/.pki/nssdb) and optional /etc/pki/nssdb
- docs/CERTIFICATES.md: manual steps (libnss3-tools, certutil, verify)
- docs/README_LONGFORM.md, EXAMPLES.md, README.md: aligned Linux instructions

2026-05-29 06:48:50 -04:00

4.5 KiB

Raw Blame History

P2NS Certificate Management

P2NS generates and manages TLS certificates for secure HTTPS connections to P2P and internal domains.

Overview

Root CA: Generated at certs/ca.cert.pem, used to sign all domain certificates
Domain Certs: Created in certs/<domain>/ with Subject Alternative Names (SANs)
SNI Support: Dynamic certificate selection based on requested hostname
Auto-Install: CA is automatically installed on supported systems

Automatic Installation

On startup, P2NS attempts to install the root CA:

Platform	Location	Method
macOS	System Keychain	`security add-trusted-cert`
Linux	`/usr/local/share/ca-certificates` + NSS (`~/.pki/nssdb`, optional `/etc/pki/nssdb`)	`update-ca-certificates` + `certutil`
Windows	Root certificate store	`certutil -addstore`

Manual Root CA Installation

If automatic installation fails, install the certificate manually.

macOS

Via Keychain Access:

Open Keychain Access (Applications > Utilities)
Select System keychain
Go to File > Import Items...
Navigate to ./certs/ca.cert.pem
Find "P2NS CA", double-click it
Expand Trust and set to Always Trust
Enter password when prompted

Via Command Line:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./certs/ca.cert.pem

Linux

Chrome and Chromium on Linux use the NSS certificate database, not only the system trust store. Install both.

Prerequisite (Debian/Ubuntu/Fedora): certutil from NSS tools, e.g. sudo apt install libnss3-tools or sudo dnf install nss-tools.

1. System trust store (curl, most CLI tools, some apps):

sudo cp ./certs/ca.cert.pem /usr/local/share/ca-certificates/p2ns-ca.crt
sudo update-ca-certificates

2. User NSS database (Chrome/Chromium for your login):

mkdir -p ~/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -D -n "P2NS CA" 2>/dev/null || true
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "P2NS CA" -i ./certs/ca.cert.pem

3. System NSS database (optional; RHEL/Fedora and some desktops):

sudo certutil -d sql:/etc/pki/nssdb -D -n "P2NS CA" 2>/dev/null || true
sudo certutil -d sql:/etc/pki/nssdb -A -t "C,," -n "P2NS CA" -i ./certs/ca.cert.pem

Restart Chrome after installing. Verify with:

certutil -d sql:$HOME/.pki/nssdb -L | grep "P2NS CA"
ls /usr/local/share/ca-certificates/p2ns-ca.crt

Windows

Open Command Prompt as Administrator:

cd C:\path\to\p2ns
certutil -addstore -f "ROOT" certs\ca.cert.pem

Browser-Specific Installation

Some browsers maintain their own certificate stores.

Firefox

Firefox requires separate installation:

Open about:preferences#privacy
Scroll to Certificates > View Certificates
Go to Authorities tab
Click Import... and select ./certs/ca.cert.pem
Check Trust this CA to identify websites

Chrome/Edge (Linux)

Prefer the NSS certutil steps in the Linux section above. GUI import also works if certutil is unavailable:

Open chrome://settings/security
Click Manage certificates
Go to Authorities tab
Click Import and select ./certs/ca.cert.pem
Check Trust this certificate for identifying websites

On macOS and Windows, Chromium uses the OS store after system installation.

Safari

Safari uses the macOS System Keychain. Follow the macOS instructions above.

Verification

After installation, verify by accessing https://p2ns.admin or https://peer.directory. You should see a valid TLS connection without certificate warnings.

Certificate Regeneration

Via the admin interface Certificates tab:

Regenerate CA: Creates new root CA (requires reinstallation)
Regenerate Domain Cert: Creates new certificate for a specific domain
Delete Domain Cert: Removes a domain's certificate

Configuration

Variable	Default	Description
`CERTS_DIR`	`./certs`	Certificate storage directory

Troubleshooting

Issue	Solution
Browser shows "Not Secure"	Linux Chrome: install NSS db + system CA; Firefox: import in browser
Chrome still untrusted on Linux	Run `certutil` for `~/.pki/nssdb`; install `libnss3-tools`; restart browser
CA expired	Regenerate via admin interface
Domain cert missing	Generate via admin Certificates tab
Permission denied	Run P2NS with sudo

4.5 KiB Raw Blame History