Install the root certificate below to trust hosts and services under TRs. Only trust the values shown on https://pki.temirs.cloud.
Download: root.crt (DER format)
31:5F:7D:3C:5B:71:96:21:0A:18:03:19:EE:FF:D1:64:29:6E:80:A4:04:58:90:0A:E5:C6:7C:28:83:10:EC:07
The same value as plain hex, as printed by sha256sum, shasum and certutil:
315f7d3c5b7196210a180319eeffd164296e80a40458900ae5c67c288310ec07
Compare the output with the fingerprint above. Install the certificate only if they match.
With OpenSSL:
openssl x509 -in root.crt -inform DER -noout -fingerprint -sha256
-inform DER: the file is binary DER. -noout: don't print the certificate itself. -fingerprint -sha256: print its SHA-256 fingerprint.
Linux:
sha256sum root.crt
macOS:
shasum -a 256 root.crt
-a 256: use SHA-256.
Windows:
certutil -hashfile root.crt SHA256
Debian, Ubuntu:
sudo openssl x509 -in root.crt -inform DER -out /usr/local/share/ca-certificates/pki.temirs.cloud-root.crt sudo update-ca-certificates
-out: write the certificate in PEM format, which update-ca-certificates expects.
Arch, Fedora:
sudo trust anchor root.crt
Windows, in an administrator prompt:
certutil -addstore Root root.crt
-addstore Root: add to the computer's Trusted Root Certification Authorities.
macOS:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain root.crt
-d: system-wide trust setting. -r trustRoot: trust as a root. -k: keychain to add it to.
iOS, before trusting: download in Safari, then Settings → General → VPN & Device Management → the profile → More Details → the certificate. Compare its SHA-256 fingerprint with the one above, then Install. Full trust is a separate step under Settings → General → About → Certificate Trust Settings.
Android: Settings → Security → Encryption & credentials → Install a certificate → CA certificate. After installing, check it under Settings → Security → Encryption & credentials → Trusted credentials → User → the certificate. Compare its SHA-256 fingerprint with the one above, and remove it if they don't match. Menu names vary by vendor. Browsers accept user-installed certificates; many apps don't.
Firefox keeps its own store: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import. On Windows and macOS, setting security.enterprise_roots.enabled to true in about:config makes it use the system store instead.
Download: crl.pem (PEM format), the certificates revoked by the CAs, one list per CA, updated after every revocation.
With OpenSSL:
openssl storeutl -noout -text -crls crl.pem
storeutl -crls: read every list in the file, openssl crl reads only the first. -noout -text: print the lists readably instead of the file itself.
Hosts present SSH certificates signed by the SSH hosts CA. Add this line to ~/.ssh/known_hosts, or to /etc/ssh/ssh_known_hosts for all users:
@cert-authority *.temirs.cloud ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHMWPSSRHnH62iG+c5g4kktl6T0keeHMtxPE/abDdJSy
@cert-authority: the key is a CA; accept any host key it certified for host names matching *.temirs.cloud. You won't be asked to confirm host keys for these hosts.