I've generated a self signed certificate using openssl - it's entirely self signed and not signed by a self signed CA. I've imported it successfully into the nss database for use by browsers. I now want to trust it globally, so that tools like wget, curl etc... don't nag.
As per instructions elsewhere, I copied my certificate to /etc/pki/ca-trust/source/anchors/ and then ran "update-ca-trust extract". Unfortunately this seems to only work on CA certificates and not on single certificates. How can I achieve what I'm after? I know I can generate a self signed CA and sign my certificate with that, but I have reasons for not doing this.
I generated my certificate like this:
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.crt
openssl x509 -sha256 -req -extensions v3_req -days 3650 -in server.csr -signkey server.key -out server.crt -extfile /etc/pki/tls/openssl.cnf
Any help would be greatly appreciated!