How to import all Root CAs from Windows store into WSL automatically?

[rfgamaral]

I have this self-signed corporate root CA installed on my Windows machine for all internal company services which is not being automatically propagated to WSL.

As a workaround I had to place the crt file under /usr/local/share/ca-certificates/*.crt and invoke sudo update-ca-certificates (this for a Debian WSL installation). The certificate will then be installed to /etc/ssl/certs/* and will also be available in the /etc/ssl/certs/ca-certificates.crt bundle.

Is it possible to configure WSL to do this automatically?

[therealkenc]

Is it possible to configure WSL to do this automatically?

It isn't.

[alanaasmaa]

To get it to work with WSL I approced this way.

1. I installed mkcert to windows with mkcert -install
2. Then i installed it to WSL mkcert -install
3. I went to directory where mkcert created CA filed for windows and copyed them to WSL location.
   So WSL now uses windows CA files.
4. I runned mkcert -install again on WSL
5. Created a certs from WSL and configurated them to apache/nginx.
   Works!

[adamdecaf]

FYI, mkcert is this tool: https://github.com/FiloSottile/mkcert

[alanaasmaa]

@adamdecaf Oh i posted the this into wrong repo 🙃

[ismailcherri]

@alanaasmaa IT WORKS! Many thanks 😄

[gernacke]

To get it to work with WSL I approced this way.

1. I installed mkcert to windows with `mkcert -install`

2. Then i installed it to WSL `mkcert -install`

3. I went to directory where mkcert created CA filed for windows and copyed them to WSL location.
   So WSL now uses windows CA files.

4. I runned `mkcert -install` again on WSL

5. Created a certs from WSL and configurated them to apache/nginx.
   Works!

this just resolved my SSL errors that I have experienced on my company Windows machines for months!!! Thanks!

[abdennour]

Thank you @gernacke for the confirmation
but could you give more details . For example , which directory location regarding point 3 I went to directory where mkcert created CA filed for windows

[gernacke]

Thank you @gernacke for the confirmation
but could you give more details . For example , which directory location regarding point 3 I went to directory where mkcert created CA filed for windows

@abdennour
Below is a note I wrote to myself for future reference:

Install mkcert on both Windows and Linux machine. Use Chocolatey to install
mkcert in Powershell. >
choco install mkcert

Check mkcert github for installation process for Linux systems.

Run below on Windows powershell. >
mkcert -install
Run below on WSL >
mkcert -install
Copy the files/or make symbolic links in the Windows mkcert folder to WSL
mkcert folder, below command will return the mkcert folder location. >
mkcert -CAROOT
Run below again in WSL, this should make WSL to respect Windows ca root
certificates. >
mkcert -install

[Nguimjeu]

I know the issue is closed, but this command helped me solved the issue of sharing Root CA between windows and WSL2

Commaand was executed in PowerShell

setx CAROOT "$(mkcert -CAROOT)"; If ($Env:WSLENV -notlike "*CAROOT*") { setx WSLENV "CAROOT/up:$Env:WSLENV" }