[Question] How to add Root CA with chromium installed by snap

[AlexandrePavy]

Hello,

Nice project work as a charm 👍,

I have a little question, I use chromium with snapcraft.

When i do mkcert -install this add Root CA in default path for chrome (and work fine this default chrome on linux) but not with chromium browser installed by snap

Default path for Root CA is sql:$HOME/.pki/nssdb but with snap is sql:/home/alexandre/snap/chromium/current/.pki/nssdb.

Do you have an idea for it to work in my case ? Can we change the default path of root CA? What is the certutils command for add the root ca in my chromium?

[adamdecaf]

Can you try adding support for that path in the NSS code? We should support both options.

• $HOME/.pki/nssdb
• $HOME/snap/chromium/current/.pki/nssdb

https://github.com/FiloSottile/mkcert/blob/master/truststore_nss.go#L16

[AlexandrePavy]

Yes add snap path should be great.

as workaround, you can add manually Root CA with this command

certutil -d sql:/home/<HomeName>/snap/chromium/current/.pki/nssdb -A -t "C,," -n 'mkcert dev' -i /home/<HomeName>/.local/share/mkcert/rootCA.pem

[adamdecaf]

@AlexandrePavy would you be able to pull down this Pull Request and try?

Branch: https://github.com/adamdecaf/mkcert/tree/more-nss-locations

[AlexandrePavy]

👍 nice i will have a look soon,

i need to build this for test

[AlexandrePavy]

Hello @adamdecaf,

I have just tried PR, sorry for the delay !

firstly I delete the existing certificate

Then when I reinstall the certificat, I have no added certificate for the chrome snap :

it does not seem to work or did something wrong?

[shaal]

Using Ubuntu 18.10
On a DDEV 1.8.0 project, I installed mkcert -install.

It works great on Google Chrome and Firefox.
But does NOT work on Chromium and on Firefox Nightly.

[adamdecaf]

@shaal can you confirm if the above additional paths would work to install and trust the certificate on your machine? If not, do you know where mkcert should install the certificate into?