Trust a Custom CA

By default, Nessus trusts certificate authorities (CAs) based on root certificates in the Mozilla Included CA Certificate list. Nessus lists the trusted CAs in the known_CA.inc file in the Nessus directory. Tenable updates known_CA.inc when updating plugins.

If you have a custom root CA that is not included in the known CAs, you can configure Nessus to trust the custom CA to use for certificate authentication.

You can use either the Nessus user interface or the command-line interface (CLI).

Note: You can also configure individual scans to trust certain CAs. For more information, see Trusted CAs.

Note: For information about using custom SSL certificates, see Create SSL Client Certificates for Login.

Note: known_CA.inc and custom_CA.inc are used for trusting certificates in your network, and are not used for Nessus SSL authentication.

Before you begin:

If your organization does not already have a custom CA, use Nessus to create a new custom CA and server certificate, as described in Create a New Server Certificate and CA Certificate.
Ensure your CA is in PEM (Base64) format.

To configure Nessus to trust a custom CA using the Nessus user interface:

In the top navigation bar, click Settings.

The About page appears.
In the left navigation bar, click Custom CA.

The Custom CA page appears.
In the Certificate box, enter the text of your custom CA.

Note: Include the beginning text -----BEGIN CERTIFICATE----- and ending text -----END CERTIFICATE-----.

Tip: You can save more than one certificate in a single text file, including the beginning and ending text for each one.
Click Save.

The CA is available for use in Nessus.

To configure Nessus to trust a custom CA using the CLI:

Save your PEM-formatted CA as a text file.

Note: Include the beginning text -----BEGIN CERTIFICATE----- and ending text -----END CERTIFICATE-----.

Tip: You can save more than one certificate in a single text file, including the beginning and ending text for each one.
Rename the file custom_CA.inc.
Move the file to your plugins directory:

Linux

/opt/nessus/lib/nessus/plugins

Windows

C:\ProgramData\Tenable\Nessus\nessus\plugins

macOS

/Library/Nessus/run/lib/nessus/plugins

The CA is available for use in Nessus.