Smile certificate authority

Internal Smile sites — the wiki, the helpdesk, everything on .intranet — are secured with Smile's own certificate authority. Your computer has to be told to trust it once. After that the warnings below stop, for every Smile site.

If your browser warned you on the way to this page, stop and ask the IT department. This page is served with the same certificate, so a warning here means something is wrong that installing a file will not fix.

The warnings this fixes

Chrome security warning
Firefox security warning
Internet Explorer security warning

You should never see these on a Smile address. Do not click through them.

On a Smile Linux workstation

Nothing to download. The certificate arrives as the smile-ca package, and stays current on its own.

If a Smile site still warns you, the machine is not getting updates. Run the two commands from Setting up or updating a machine — they fix that as well as the certificate.

Everywhere else

Windows, macOS, a personal machine, a server: install the file by hand.

Download smile-root-ca-g2.crt — one file, the only one you need. It is valid until 30 December 2029.

Check what you downloaded is what we published. Its SHA-256 fingerprint:

FC:E0:92:73:9A:2D:FA:C7:7E:89:D2:28:A6:68:C7:F6:A9:3C:E5:54:A0:27:C9:97:6C:A2:F0:A8:31:70:20:7B

If you installed this certificate before September 2026, install it again: it was renewed with the same key, and the new file replaces the old entry.

Chrome and Edge on Windows

Open the downloaded file and follow the wizard. The one step that matters: place the certificate in Trusted Root Certification Authorities, not wherever Windows offers by default.

Close every browser window and open it again.

Firefox

Firefox keeps its own list. Open the downloaded file and tick Trust this CA to identify websites.

Chrome on Linux

Go to chrome://settings/certificates, open Authorities, choose Import, and select the file you downloaded.

For system administrators

Same file, into the system trust store:

curl -fsSLo /usr/local/share/ca-certificates/smile-root-ca-g2.crt \
     https://pki.smile.fr/smile-root-ca-g2.crt
update-ca-certificates

Windows, elevated prompt:

certutil -addstore -f Root smile-root-ca-g2.crt

A server that presents its own certificate also needs the issuing intermediate in its chain — smile-chain-g3.pem holds the intermediate and the root together. Server certificates are issued over ACME from the internal CA; ask the DSI team for the directory URL and the role for your DNS zone.

The remaining files here are for specific cases — historical names kept for automation that still uses them, and the previous issuing CA. They are described on the wiki: Smile Certificate Authority. Checksums for everything served here are in SHA256SUMS.