# Installing CA Certificates

When using a school or work network, you may be required to install a Root CA certificate to allow you to browse to secure websites (those that use HTTPS, which includes most websites nowadays!). The Root CA certificate is required because the traffic is being decrypted by the firewall or filter, then re-encrypted. Internet browsers will rightly detect this as a man-in-the-middle (MITM) attack, and will therefore throw up errors preventing you from continuing to load the page.

<p class="callout danger">Installing the required CA certificate will remove certificate errors, but you must be aware that this means **all** traffic will be viewable by your school or employer.</p>

##### Copying the certificate

Ubuntu looks in specific folders for CA certificates. The exact location depends on the version - to do this on 20.04 (Focal) you will need to use a command similar to this. This copies the CA and changes it's extension from .cer (or .crt) to .pem:

```shell
sudo cp mycert.cer /usr/share/ca-certificates/local/mycert.pem
```

<p class="callout info">Older versions of Ubuntu may look in the following locations</p>

`/usr/share/ca-certificates/`  
`/usr/local/share/ca-certificates/`

##### Enabling the certificate

Our certificate is now within one of the required locations, but due to the nature of certificate trust, we will need to enable it via dpkg:

```shell
sudo dpkg-reconfigure ca-certificates
```

##### Updating the certificate cache

After enabling the certificate via dpkg, we must run the update-ca-certificates comand

```shell
sudo update-ca-certificates
```

##### Configuring git to use the certificate

Git has a separate setting for CA certificates, so we must set it using this command:

```shell
git config --global http.sslCAInfo /usr/share/ca-certificates/mycert.pem
```