I've a self-signed certificate in /etc/pki/trust/anchors/, and would like to propagate it to certificate stores used by openssl /var/lib/ca-certificates/.
My certificate is created with subjectAltName, but update-ca-certificates failed to propagate it to /var/lib/ca-certificates/*/
Is there anything wrong? Thanks!

-------------openssl.conf -------
[req]
distinguished_name=user_dn
x509_extensions=v3_req
prompt=no

[user_dn]
commonName=stage-host-18.xxx.com
organizationName=YourCompany, Inc.
organizationalUnitName=Division
countryName=US

[v3_req]
# Extensions to add to a certificate request
subjectAltName = @alt_names

[alt_names]
DNS.1 = stage-host-18.xxx.com
-------------end --------------
The command I used:
% openssl req -x509 -days 10000 -newkey rsa:2048 -nodes -config /tmp/openssl.conf -keyout $TMP_DIR/key.pem -out $TMP_DIR/cert.pem
% cp $TMP_DIR/cert.pem /etc/pki/trust/anchors/
% update-ca-certificates

But the cert isn't exported to /var/lib/ca-certificates/pem.
If I comment out 'x509_extensions=v3_req', the new generated CA could be exported.
Is there anything I msised?

The steps/conf works on ubuntu. What's special of sles12's ca-certificates package?


The doc I referred:
https://www.suse.com/releasenotes/x8...2/#fate-317835