tested with Google Chrome v124
cp -a ~/.pki/ ~/.pki.`date +%s`/
cert=cert_file.crt nick=cert_file cd ~/.pkg/nssdb/ ls -lF $cert certutil -d sql:$HOME/.pki/nssdb -A -t "C" -n $nick -i $cert
cert=something.internal.crt nick=something.internal site=something.internal cd ~/.pki/nssdb/ echo Q | openssl s_client -connect $site:443 > $site.crt openssl x509 -in $cert -noout -sha256 -fingerprint certutil -d sql:$HOME/.pki/nssdb -A -t "P" -n $nick -i $cert
curl -I https://something.internal/
https://manpages.debian.org/bookworm/libnss3-tools/certutil.1.en.html ==> -t
https://superuser.com/questions/1772957/how-to-trust-a-self-signed-ssl-root-ca-in-chrome-on-debian-via-terminal ==> see second edit
https://superuser.com/questions/104146/add-permanent-ssl-certificate-exception-in-chrome-linux ==> linked from above
https://unix.stackexchange.com/questions/77794/where-does-chrome-gets-its-list-of-certificate-authorities-from ==> finally, the location of the system-wide trust store
https://stackoverflow.com/questions/22030264/how-can-i-create-a-sha256-fingerprint-in-openssl