Trust and certificates

Seemi Cloud CA certificates

Services such as MySQL and StarRocks present TLS certificates issued by the Seemi Cloud certificate authority. Trust our CA once and your applications, servers and devices can verify those connections.

Restricted to seemi.net and seemi.cloud. Both certificates carry X.509 name constraints, so they can never vouch for other websites or for IP addresses. Connect to services by hostname.

One permanent URL

Always serves the current bundle (root and issuing CA) for command-line and headless clients.

cloud.seemi.net/ca.pemcurl
curl -fsSLO https://cloud.seemi.net/ca.pem
wget
wget https://cloud.seemi.net/ca.pem
PowerShell
Invoke-WebRequest https://cloud.seemi.net/ca.pem -OutFile ca.pem

Download

Certificates and formats

PEM is used by Linux, macOS and most software. DER opens the certificate import wizard on Windows. If you only need one file, use ca.pem.

ca.pem: trust bundle

Root and issuing CA in one file. Use it as the CA file in applications and on Linux.

SHA-256 (file)
9faeb99a53b6fdf9f37a83ba642d6f47b2e0a4a74daf29f45cdebf91037d7301
ca.pem

Root CA

Seemi Cloud Root CA R1

Install this certificate in operating-system trust stores.

Issued by
Seemi Cloud Root CA R1
Valid
2026-11-02 to 2051-11-02 (UTC)
SHA-256 fingerprint
D9:0C:AD:B9:59:DB:E5:05:3F:71:83:28:53:BE:9E:D7:CA:89:0C:76:97:8E:9E:3D:32:26:79:E5:44:D5:91:DA
SHA-1 thumbprint (Windows)
74:5C:93:43:FF:9D:DB:D7:2D:43:36:EB:27:7F:76:5F:6A:65:4E:40
root-r1.pem root-r1.der

Issuing CA

Seemi Cloud Issuing CA R1

Signs Seemi Cloud service certificates. Servers send it automatically; it is also included in ca.pem.

Issued by
Seemi Cloud Root CA R1
Valid
2026-11-02 to 2036-11-01 (UTC)
SHA-256 fingerprint
E2:CA:3A:0E:06:BB:61:5B:87:1A:4E:47:87:37:D0:EC:30:15:8E:58:D9:D5:26:BC:C0:15:96:0C:A4:8A:3E:A0
SHA-1 thumbprint (Windows)
D1:69:BA:4F:83:BF:D3:AC:C3:A4:A7:CA:74:12:AC:66:35:B4:D8:60
ica-r1.pem ica-r1.der

Verify

Check the download before you trust it

The SHA-256 of each file must match the list below. For the .der files it is also the certificate fingerprint shown above and in your operating system.

Linux
sha256sum ca.pem
macOS
shasum -a 256 ca.pem
Windows
Get-FileHash .\ca.pem -Algorithm SHA256
Scripted (Linux)
curl -fsSLO https://cloud.seemi.net/pki/sha256sums.txt
sha256sum -c --ignore-missing sha256sums.txt
SHA-256 checksums
FileSHA-256
ca.pem9faeb99a53b6fdf9f37a83ba642d6f47b2e0a4a74daf29f45cdebf91037d7301
ca.tar.gz0f23c2c90b7a4444e115221e065041c47d6641ff5c802268bd9e58a6ed44b876
ca.zipc870f01a478063e5d6b411b537a9d761a6ce77fee3508f512ce663a2dfbbe1ae
ica-r1.dere2ca3a0e06bb615b871a4e478737d0ec30158e58d9d526bcc015960ca48a3ea0
ica-r1.pemaf86c628921a165ed3c60c0954082842e82b56566064277b86bbc3e38d20957f
readme.txt731b8c6e14b634c0a3f6d23687b433592f6ebc9ff328c318ebcf657e0ecbd32b
root-r1.derd90cadb959dbe5053f71832853be9ed7ca890c76978e9e3d322679e544d591da
root-r1.peme028c7b23a634edc7a5c7c43f20cfe6f8ef631f7e28cd718fce7c26fa480394e
sha256sums.txtdea8f2f3602130b1cbbcce31c056006bce59819664ad6732fd228f3136e7c3c2

Install

Trust the CA on your system

Run the steps for your platform, then restart applications that were already running. Linux and Docker use the bundle URL; Windows and macOS only need the root CA.

Debian, Ubuntu, Alpine

Save the bundle with a .crt extension and rebuild the system trust store.

sudo curl -fsSL https://cloud.seemi.net/ca.pem -o /usr/local/share/ca-certificates/seemi-cloud.crt
sudo update-ca-certificates

RHEL, Fedora, Rocky, AlmaLinux

Place the bundle in the trust anchors folder and update the trust store.

sudo curl -fsSL https://cloud.seemi.net/ca.pem -o /etc/pki/ca-trust/source/anchors/seemi-cloud.pem
sudo update-ca-trust

Windows

In PowerShell as Administrator, add the root CA to Trusted Root Certification Authorities.

Invoke-WebRequest https://cloud.seemi.net/pki/root-r1.der -OutFile root-r1.der
Import-Certificate -FilePath .\root-r1.der -CertStoreLocation Cert:\LocalMachine\Root

macOS

Add the root CA to the System keychain as a trusted root.

curl -fsSLO https://cloud.seemi.net/pki/root-r1.pem
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain root-r1.pem

Docker images

Add the bundle at build time. The checksum makes the build fail if the file ever changes. On Alpine, install ca-certificates with apk instead.

# syntax=docker/dockerfile:1
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*
ADD --chmod=644 --checksum=sha256:9faeb99a53b6fdf9f37a83ba642d6f47b2e0a4a74daf29f45cdebf91037d7301 \
    https://cloud.seemi.net/ca.pem /usr/local/share/ca-certificates/seemi-cloud.crt
RUN update-ca-certificates

One application only

Leave the operating system unchanged and point the client at ca.pem.

mysql CLI
--ssl-ca=ca.pem --ssl-mode=VERIFY_IDENTITY
psql / libpq
sslmode=verify-full sslrootcert=ca.pem
MySqlConnector
SslMode=VerifyFull;SslCa=ca.pem
Npgsql
SSL Mode=VerifyFull;Root Certificate=ca.pem
curl
--cacert ca.pem
Node.js
NODE_EXTRA_CA_CERTS=ca.pem